Booster for WooCommerce - ShopManager+ Arbitrary File Download

The plugins do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)

PoC

Enable the “Checkout File Upload” module and open the following URL as a shop manager or admin: https://example.com/wp-admin/?wcj_download_checkout_file_admin=../../../../../wp-config.php&post;=1&wcj;_checkout_file_number=1 (the post and wcj_checkout_file_number parameters are irrelevant) Enable the “Product Init Fields” module and open the following URL as a shop manager or admin: http://example.com/wp-admin/?wcj_download_file=../../../../../wp-config.php System files such as /etc/passwd can also be retrieved that way