Vulnerability · Published Apr 25, 2022 · Assigned by WPScan
CVE-2022-1391Cab fare calculator < 1.0.4 - Unauthenticated LFI
Critical 9.8
In plain English
A critical-severity path traversal in Cab fare calculator from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.1% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)15.1%top 3.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Cab fare calculator | 1.0.4 – before 1.0.4 |
Weakness: CWE-22
References
- https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac x_refsource_MISC
- https://packetstormsecurity.com/files/166533/ x_refsource_MISC