WordPress Swim Team Plugin 1.44.10777 - Arbitrary File Download

<p>The code in ./wp-swimteam/include/user/download.php doesn't&nbsp;sanitize user input from downloading sensitive&nbsp;system files:</p><p>&nbsp;</p><p>&nbsp;50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $file = urldecode($args['file'])&nbsp;;</p><p>&nbsp;51 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $fh = fopen($file, 'r') or die('Unable to load file, something bad has&nbsp;happened.') ;</p><p>&nbsp;52&nbsp;</p><p>&nbsp;53 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while (!feof($fh))</p><p>&nbsp;54 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $txt .= fread($fh, 1024) ;</p><p>&nbsp;55&nbsp;</p><p>&nbsp;56 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // &nbsp;Clean up the temporary file&nbsp;- permissions</p><p>&nbsp;57 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // &nbsp;may prevent this from&nbsp;succeedeing so use the '@'</p><p>&nbsp;58 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // &nbsp;to suppress any messages&nbsp;from PHP.</p><p>&nbsp;59&nbsp;</p><p>&nbsp;60 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @unlink($file) ;</p><p>&nbsp;61 &nbsp; &nbsp; &nbsp; &nbsp; }</p><p>&nbsp;62&nbsp;</p><p>&nbsp;63 &nbsp; &nbsp; &nbsp; &nbsp; $filename = urldecode($args['filename']) ;</p><p>&nbsp;64 &nbsp; &nbsp; &nbsp; &nbsp; $contenttype = urldecode($args['contenttype']) ;</p><p>&nbsp;65&nbsp;</p><p>&nbsp;66 &nbsp; &nbsp; &nbsp; &nbsp; // Tell browser to expect a text&nbsp;file of some sort (usually txt or csv)</p><p>&nbsp;67&nbsp;</p><p>&nbsp;68 &nbsp; &nbsp; &nbsp; &nbsp; header(sprintf('Content-Type:&nbsp;application/%s', $contenttype)) ;</p><p>&nbsp;69 &nbsp; &nbsp; &nbsp; &nbsp; header(sprintf('Content-disposition:&nbsp;attachment; filename=%s', $filename)) ;</p><p>&nbsp;70 &nbsp; &nbsp; &nbsp; &nbsp; print $txt ;</p>