############################################################################################ # Exploit Title : WordPress 5.1.1 Green_Farming_New Themes Arbitrary File Download # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 18/03/2019 # Vendor Homepage : wordpress.org ~ greenfarming.in ~ wscubetech.com # Software Information Link : wscubetech.com/web-development-company-india-about-us.html greenfarming.in/?page_id=75 # Software Affected Version : 5.1.1 # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Google Dorks : inurl:''/wp-content/themes/green_farming_new/" intext:''Designed & Developed By WsCube Tech'' # Vulnerability Type : CWE-200 [ Information Exposure ] CWE-23 [ Relative Path Traversal ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################################ # Information About Software : **************************** WsCube Tech is one of the leading Web Design and Development company in jodhpur, India. ############################################################################################ # Impact : *********** * WordPress 5.1.1 Green_Farming_New is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the context of the web server process and obtain potentially sensitive informations and it works for open redirection vulnerability. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The software has Relative Path Traversel vulnerability and it uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. ############################################################################################ # Vulnerable File => ****************** /download.php # Vulnerable Parameter => *********************** ?download_file= # Arbitrary File Download Exploit : ******************************** /wp-content/themes/green_farming_new/download.php?download_file=[FILENAME] ############################################################################################ # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ############################################################################################