Description
WordPress Plugin WP-Lytebox is prone to a vulnerability which can be exploited by malicious people to disclose sensitive information. Input passed to the "pg" parameter in wp-lytebox/main.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks. WordPress Plugin WP-Lytebox version 1.3 is vulnerable; other versions may also be affected.
Remediation
Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available
References
http://www.f-secure.com/vulnerabilities/SA200902421
http://www.exploit-db.com/exploits/8791/
http://packetstormsecurity.com/files/view/77831/wplytebox-lfi.txt
Related Vulnerabilities
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2020-11057)
MySQL CVE-2021-2170 Vulnerability (CVE-2021-2170)
MySQL CVE-2022-21372 Vulnerability (CVE-2022-21372)
Jboss EAP Credentials Management Errors Vulnerability (CVE-2009-5066)
WordPress Plugin InstaWP Connect-1-click WP Staging & Migration Security Bypass (0.1.0.38)