[+] Post Local File Disclosure in wordpress theme Infocus [+] Date: 07/06/2014 [+] CWE Number: CWE-98 [+] Risk: High [+] Author: Felipe Andrian Peixoto [+] Dork:inurl:"/wp-content/themes/infocus/" [+] Vendor Homepage: http://themeforest.net/item/infocus-powerful-professional-wordpress-theme/85486 [+] Contact: felipe_andrian@hotmail.com [+] Tested on: Windows 7 and Linux [+] Vulnerable File: dl-skin.php [+] Exploit :
Download:
[+] PoC: http://www.sonorabehavioral.com/wp-content/themes/infocus/lib/scripts/dl-skin.php http://www.harmonyhouse.uk.com/wp-content/themes/infocus/lib/scripts/dl-skin.php http://foulaneautoecole.com/wp-content/themes/infocus/lib/scripts/dl-skin.php eof