Local File Inclusion in domokeeper
Moderate severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Jan 9, 2023
All versions of
domokeeper
are vulnerable to Local File Inclusion. The/plugin/
route passes a GET parameter unsanitized to arequire()
call. It then returns the output ofrequire()
in the server response. This may allow attackers to load unintended code in the application. It also allows attackers to exfiltrate information in.json
files.Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
References