CVEs-PoC/2015/CVE-2015-5471.md

CVE-2015-5471

Description

Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.

POC

Reference

• http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html
• http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html
• https://wpvulndb.com/vulnerabilities/8071
• https://wpvulndb.com/vulnerabilities/8071

Github

• https://github.com/ARPSyndicate/kenzer-templates