Description
Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Webgrind <= 1.5 - Local File Inclusion http/cves/2018/CVE-2018-12909.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.