CVE-2014-125090: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-04T20:15Z
Repository: https://github.com/wp-plugins/media-downloader
Language: PHP
Files changed: getfile.php, mediadownloader.php, readme.txt
Commit date: 2014-01-23 11:16:05 +0000
Commit message: Trying to fix vulnerability (cross site scripting) reported by Ipstenu (Mika Epstein)
 on January 6 2014.

git-svn-id: https://plugins.svn.wordpress.org/media-downloader/trunk@843732 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/getfile.php b/getfile.php
index 8be782b..d5dc535 100755
--- a/getfile.php
+++ b/getfile.php
@@ -15,11 +15,11 @@ dl_file_resumable($filepath);
 function dl_file_resumable($file, $is_resume=TRUE)
 {
     //First, see if the file exists
     if ( !is_file($file) && ( $file = stripslashes( $file ) ) && !is_file($file) )
     {
-        die("<b>404 File not found! <!-- $file --></b>");
+        die("<b>404 File not found! <!-- Searched for file: \"" . htmlentities( $file ) . "\" --></b>");
     }
 
     //Gather relevent info about file
     $size = filesize($file);
     $fileinfo = pathinfo($file);
diff --git a/mediadownloader.php b/mediadownloader.php
index 4d834de..e77d28c 100755
--- a/mediadownloader.php
+++ b/mediadownloader.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: Media Downloader
 Plugin URI: http://ederson.peka.nom.br
 Description: Media Downloader plugin lists MP3 files from a folder by replacing the [media] smarttag.
-Version: 0.1.992
+Version: 0.1.993
 Author: Ederson Peka
 Author URI: http://ederson.peka.nom.br
 */
 
 // Possible encodings
diff --git a/readme.txt b/readme.txt
index dda567f..423b148 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === Media Downloader ===
 Contributors: Ederson Peka, Jonathan Jose from www.flowconversatilidad.net (Spanish Translation)
 Tags: media, audio, podcast, post, player, mp3, flash
 Requires at least: 3.0
 Tested up to: 3.6
-Stable tag: 0.1.992
+Stable tag: 0.1.993
 Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=ederson@gmail.com&lc=BR&currency_code=BRL&item_name=Media%20Downloader%20Wordpress%20Plugin
 
 Lists MP3 files from a folder. Portuguese: Lista arquivos MP3 de um diretório. Spanish: Lista todos los MP3 de un directorio.
 
 == Description ==

Vulnerable code:         die("<b>404 File not found! <!-- $file --></b>");
Version: 0.1.992
Stable tag: 0.1.992
Fixed code:         die("<b>404 File not found! <!-- Searched for file: \"" . htmlentities( $file ) . "\" --></b>");
Version: 0.1.993
Stable tag: 0.1.993