CVE-2018-7422

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the Site Editor WordPress plugin (version 1.1.1). The ajax_path parameter in ajax_shortcode_pattern.php is unsanitized, allowing remote attackers to include arbitrary files via a crafted request.

This is a functional exploit for CVE-2018-7422, a Local File Inclusion (LFI) vulnerability in the WordPress Plugin Site Editor 1.1.1. The script crafts a malicious request to read arbitrary files from the target system via a vulnerable AJAX endpoint.

This is a functional exploit PoC for CVE-2018-7422, a Local File Inclusion (LFI) vulnerability in the WordPress Plugin Site Editor 1.1.1. It crafts a malicious HTTP request to read arbitrary files from the target system via a vulnerable AJAX endpoint.

This PowerShell script exploits a Local File Inclusion (LFI) vulnerability in the WordPress Site-Editor plugin (v1.1.1) by sending a crafted HTTP request to retrieve arbitrary files from the server. The exploit leverages unsanitized user input in the 'ajax_path' parameter.

This repository contains a Nuclei template for detecting CVE-2018-7422, an unauthenticated arbitrary file read vulnerability in WordPress Site Editor plugin. The template sends a crafted GET request to read /etc/passwd and checks for a successful response.