The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files: 50 $file = urldecode($args['file']) ; 51 $fh = fopen($file, 'r') or die('Unable to load file, something bad has happened.') ; 52 53 while (!feof($fh)) 54 $txt .= fread($fh, 1024) ; 55 56 // Clean up the temporary file - permissions 57 // may prevent this from succeedeing so use the '@' 58 // to suppress any messages from PHP. 59 60 @unlink($file) ; 61 } 62 63 $filename = urldecode($args['filename']) ; 64 $contenttype = urldecode($args['contenttype']) ; 65 66 // Tell browser to expect a text file of some sort (usually txt or csv) 67 68 header(sprintf('Content-Type: application/%s', $contenttype)) ; 69 header(sprintf('Content-disposition: attachment; filename=%s', $filename)) ; 70 print $txt ;