CVE-2019-25779: WooThemes Diarise 1.5.9 Local File Disclosure via download.php
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can send an HTTP GET request to the affected download.php endpoint can attempt exploitation. No credentials or user interaction are required.
What access can a successful attacker gain?
An attacker can read arbitrary files by supplying a file:// path through the calendar parameter. The description specifically identifies sensitive files such as /etc/passwd as potential targets.
How can I determine whether exploitation has been attempted?
Review web server and application logs for requests to download.php where the calendar parameter contains file:// paths or references to sensitive filesystem locations. Exploitation evidence was first observed on 2023-10-19.