Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-4940. PoCs published by Anant Shrivastava. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a local file inclusion vulnerability in the Tera Charts WordPress plugin. By manipulating the 'fn' parameter, an attacker can read arbitrary files on the server, such as '/etc/passwd'.
Description
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
Exploits (2)
This exploit demonstrates a local file inclusion vulnerability in the Tera Charts WordPress plugin. By manipulating the 'fn' parameter, an attacker can read arbitrary files on the server, such as '/etc/passwd'.
This exploit demonstrates a local file inclusion (LFI) vulnerability in the Tera Charts WordPress plugin. The vulnerability allows an attacker to read arbitrary files on the server by manipulating the 'fn' parameter in the 'treemap.php' script.