Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read

Proof of Concept

1) Create a new form with a file upload field.
2) Upload a file to the form created.
3) View the submission in the "All submissions" page and click "Show"
3) Under "File Attachments" you should see the file you uploaded
4) Right-click on the file and copy the url
5) Now paste the url in a new window
6) Change the "&file=" content from the file you uploaded to "../../../../../../../../../../../etc/passwd"
7) The browser will be prompted to download the file.