vendor:
HD FLV Player
by:
Claudio Viviani
7,5
CVSS
HIGH
Arbitrary File Download
434
CWE
Product Name: HD FLV Player
Affected Version From: 2.1.0.1
Affected Version To: 2.1.0.1
Patch Exists: YES
Related CWE: N/A
CPE: a:hdflvplayer:hd_flv_player
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: BackBox 3.x/4.x
2014
Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability
The variable 'f' in the URL http://target/components/com_hdflvplayer/hdflvplayer/download.php?f= is not sanitized, allowing an attacker to download arbitrary files from the server.
Mitigation:
Sanitize the 'f' variable in the URL http://target/components/com_hdflvplayer/hdflvplayer/download.php?f=.