WordPress Plugin Cab-Fare-Calculator Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WordPress plugin Cab Fare Calculator, version 1.0.3. This vulnerability allows unauthenticated attackers to read arbitrary files by manipulating the 'controller' parameter in 'tblight.php'. Exploitation involves using path traversal sequences to include and execute files outside the designated controllers directory.

Impact

Exploitation of this vulnerability could lead to unauthorized reading of sensitive files on the server. Additionally, if the included file is a PHP script, it could be executed, potentially allowing for further exploitation of the application or server.

Reproduction

To reproduce this vulnerability, send a GET request to 'wp-content/plugins/cab-fare-calculator/tblight.php' with the 'controller' parameter set to a path traversal sequence that points to a file outside the plugin directory, such as '/etc/passwd'. Include the 'action' parameter set to '1' and the 'ajax' parameter set to '1'.