CVE-2012-10016: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-10-17T00:15Z
Repository: https://github.com/wp-plugins/simple-download-button-shortcode
Language: PHP
Files changed: simple-download-button.php, simple-download-button_dl.php
Commit date: 2012-09-17 23:43:36 +0000
Commit message: ver1.1 Reported vulnerability corrected

git-svn-id: https://plugins.svn.wordpress.org/simple-download-button-shortcode/trunk@600290 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/simple-download-button.php b/simple-download-button.php
index b6bbff5..3f95561 100644
--- a/simple-download-button.php
+++ b/simple-download-button.php
@@ -2,11 +2,11 @@
 /**
  * Plugin name: Simple Download Button Shortcode
  * Plugin URI: http://tech.halulu.org/?p=849
  * Author: <a href="http://www.halulu.tech/">Halulu</a>
  * Author URI: http://tech.halulu.org/?p=849
- * Version: 1.0
+ * Version: 1.1
  * Description:ショートコードでダウンロードボタンを表示。DLプログラム付きでソースコードや画像もダウンロードできます。Display CSS3 dwonload bottons by simple Shortcode. This plugin comes with a downloading program that let site visitors donwload source code and images, such as html, php and jpeg.
  */
 
  /*  Copyright 2012 Halulu (email : info@halulu.org)
 
@@ -85,21 +85,19 @@ function disp_downloadButton($atts) {
 		array(
 			'%style%',
 			'%plugin_url%',
 			'%file%',
 			'%label%',
-			'%name%',
-			'%download_dir%'
+			'%name%'
 		),
 		array(
 			$style,
 			$plugin_url,
 			$file,
-			$label,
-			$download_dir
+			$label
 		),
-		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%&download_dir=%download_dir%\'"><b>%label%</b></button></div>'
+		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%\'"><b>%label%</b></button></div>'
 	);	
 	
 	return $html;
 }
 
diff --git a/simple-download-button_dl.php b/simple-download-button_dl.php
index 196689c..d490150 100644
--- a/simple-download-button_dl.php
+++ b/simple-download-button_dl.php
@@ -3,21 +3,31 @@
 	// download files containing dir	
 	$download_dir	= dirname(__FILE__). '/download/';
 
 	/* GET param */
 	$filename = $_GET['file'];
-	if(!$filename){ die("ERROR: a file name to download is not set!"); }
-	
-	$download_filepath = $download_dir. $filename;
+		
+	/* Verify file parameter */
+	$fileinfo =	pathinfo($filename);	
+	if(!$fileinfo['filename']){
+		die("ERROR: Downloading filename is not set. Please set the name. the short code should be wriiten like [dlbt file=dummy.html] ");
+	}elseif(!$fileinfo['extension']){
+		die("ERROR: Unappropriate downloading filename: $filename: no extention.");		
+	}
+	if(!preg_match('/^[a-zA-Z0-9_-]/',$fileinfo['filename'])) {
+		die("ERROR: Unappropriate downloading filename: $filename: filename can contains only 'a-z', 'A-Z' '0-9', '-' and '_'");		
+	}
+	// making file path		
+	$download_filepath = $download_dir. $fileinfo['filename']. '.'. $fileinfo['extension'];
 	
 	// set a file name showed in the dialog box.
 	if(!$dispname){$dispname = $filename;}
 	mb_convert_encoding($dispname, "UTF-8");
 
 	/* set the Content-type depends on the extention */
 	if (!file_exists($download_filepath)) {
-		die("ERROR: There is not shuch file. Please hit the back button to return.");
+		die("ERROR: There is not shuch file at $download_filepath.");
 	}else{
 		$file_info = pathinfo($download_filepath);
 		$ext = strtolower($file_info["extension"]);
 		switch ($ext) {
 			case "pdf":

Vulnerable code:  * Version: 1.0
			'%name%',
			'%download_dir%'
			$label,
			$download_dir
		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%&download_dir=%download_dir%\'"><b>%label%</b></button></div>'
	if(!$filename){ die("ERROR: a file name to download is not set!"); }
	
	$download_filepath = $download_dir. $filename;
		die("ERROR: There is not shuch file. Please hit the back button to return.");
Fixed code:  * Version: 1.1
			'%name%'
			$label
		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%\'"><b>%label%</b></button></div>'
		
	/* Verify file parameter */
	$fileinfo =	pathinfo($filename);	
	if(!$fileinfo['filename']){
		die("ERROR: Downloading filename is not set. Please set the name. the short code should be wriiten like [dlbt file=dummy.html] ");
	}elseif(!$fileinfo['extension']){
		die("ERROR: Unappropriate downloading filename: $filename: no extention.");		
	}
	if(!preg_match('/^[a-zA-Z0-9_-]/',$fileinfo['filename'])) {
		die("ERROR: Unappropriate downloading filename: $filename: filename can contains only 'a-z', 'A-Z' '0-9', '-' and '_'");		
	}
	// making file path		
	$download_filepath = $download_dir. $fileinfo['filename']. '.'. $fileinfo['extension'];
		die("ERROR: There is not shuch file at $download_filepath.");