WordPress Plugin Vulnerabilities
Videos sync PDF <= 1.7.4 - Unauthenticated LFI
Description
The plugin does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues
Proof of Concept
https://example.com/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=LFI
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Hassan Khan Yusufzai - Splint3r7
Verified
Yes
Timeline
Publicly Published
2022-03-30 (about 3 months ago)
Added
2022-03-30 (about 3 months ago)
Last Updated
2022-04-20 (about 2 months ago)