Description

WordPress Plugin Download Zip Attachments is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently verify user-supplied input. This may allow an attacker to gain access to sensitive information, which may aid in launching further attacks. WordPress Plugin Download Zip Attachments version 1.0.0 is vulnerable.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

http://www.vapidlabs.com/advisory.php?v=129

http://www.openwall.com/lists/oss-security/2015/06/23/4

http://seclists.org/oss-sec/2015/q2/787

https://packetstormsecurity.com/files/132459/Download-Zip-Attachments-1.0-File-Download.html

Related Vulnerabilities

Chamilo Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2023-3368)

phpBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-16108)

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Multiple Vulnerabilities (7.0.0)

Oracle Database Server CVE-2006-5344 Vulnerability (CVE-2006-5344)

Oracle HTTP Server Out-of-bounds Write Vulnerability (CVE-2021-44790)

Severity

High

Classification

CVE-2015-4704 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure