This host is installed with Wordpress Advanced Dewplayer Plugin and is prone to directory traversal vulnerability.

Successful exploitation will allow remote attackers to read arbitrary files on the target system. Impact Level: Application

Upgrade to WordPress Advanced Dewplayer 1.3 or later, For updates refer to http://wordpress.org/plugins/advanced-dewplayer

Flaw is due to the 'download-file.php' script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'dew_file' parameter.

WordPress Advanced Dewplayer 1.2, Other versions may also be affected.

Send a crafted data via HTTP GET request and check whether it is able to read local file or not.

• http://seclists.org/oss-sec/2013/q4/566
• http://secunia.com/advisories/55941
• http://www.osvdb.com/101513

---

Updated on 2015-03-25