Lana Downloads Manager < 1.8.0 – Contributor+ Arbitrary File Download | CVE 2022-2392 | Plugin Vulnerabilities

Description

The plugin is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.

Proof of Concept

# As contributor, navigate to https://target/blog/wp-admin/post-new.php?post_type=lana_download

# Inside "File (URL):" input, fill the file you want to download, for example: wp-config.php

# Save the post

# To download the file, you will be able to see a link that will directly download file

https://target/blog/download/1/

Affects Plugins

lana-downloads-manager

Fixed in 1.8.0

References

CVE

Classification

Type

FILE DOWNLOAD

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Raad Haddad of Cloudyrion GmbH

Submitter

Raad Haddad of Cloudyrion GmbH

Submitter twitter

Verified

Yes

WPVDB ID

5001ed18-858e-4c9d-9d7b-a1305fcdf61b

Timeline

Publicly Published

2022-08-01 (about 3 years ago)

Added

2022-08-01 (about 3 years ago)

Last Updated

2023-04-28 (about 2 years ago)

Other

Published

Title

Published

2022-07-11

Title

Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download

Published

2019-06-02

Title

Simple File List < 3.2.8 - Unauthenticated Arbitrary File Download

Published

2022-12-05

Title

Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

Published

2025-02-23

Title

Download Manager < 3.3.07 - Unauthenticated Data Exposure

Published

2022-04-05

Title

Download Monitor < 4.5.91 - Admin+ Arbitrary File Download