DZS Video Gallery < 7.95 - Limited Local File Inclusion
2014-09-27 00:00
aceeeeeeeerStrategic Overview
Vulnerability Overview
The DZS Video Gallery plugin for WordPress is vulnerable to remote/local file inclusion in versions up to, and excluding, 7.95. This can allow unauthenticated attackers to retrieve local and remote files with a .swf extension.
Technical Analysis
REMEDIATION: Update to version 7.95, or a newer patched version --- IDENTIFIER: CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')) The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C