CVEs-PoC/2013/CVE-2013-7240.md

CVE-2013-7240

Description

Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.

POC

Reference

• http://seclists.org/oss-sec/2013/q4/566
• http://seclists.org/oss-sec/2013/q4/570

Github

• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/JNado/CST312-WordPressExploits