vendor:
Google MP3 Audio Player
by:
QK14 Team
7,5
CVSS
HIGH
File Disclosure Download
200
CWE
Product Name: Google MP3 Audio Player
Affected Version From: 1.0.11
Affected Version To: 1.0.11
Patch Exists: NO
Related CWE: N/A
CPE: a:codeart:google_mp3_audio_player:1.0.11
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: WordPress
2014
WordPress CodeArt Google MP3 Player plugin – File Disclosure Download
This plugin is vulnerable to File Disclosure Download. Thanks to this vulnerability, a user can download the configuration file config.php and extract from it the access data to the Database.
Mitigation:
Ensure that the application is not vulnerable to file disclosure attacks by validating user input and restricting access to sensitive files.
