Apptha Slider Gallery Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Apptha Slider Gallery WordPress plugin, version 1.0. This vulnerability allows unauthenticated attackers to download arbitrary files by manipulating the 'imgname' parameter. Exploitation involves sending requests to 'asgallDownload.php' with directory traversal sequences to access sensitive files outside the intended directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access and download of sensitive files from the server.

Reproduction

To reproduce this vulnerability, send a request to 'asgallDownload.php' with the 'imgname' parameter. Include directory traversal sequences to navigate outside the intended directory and access sensitive files. This can be done using a web browser or a tool like cURL or Postman.