CVE-2012-10016 (published 2023-10-17T00:15Z)

A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/wp-plugins/simple-download-button-shortcode
commit_details: repo_url: https://github.com/wp-plugins/simple-download-button-shortcode
author: halulu
author_date: 2012-09-17 23:43:36+00:00
msg: ver1.1 Reported vulnerability corrected

git-svn-id: https://plugins.svn.wordpress.org/simple-download-button-shortcode/trunk@600290 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/simple-download-button-shortcode
repo_name: wp-plugins/simple-download-button-shortcode
description: WordPress.org Plugin Mirror
owner: wp-plugins
file_changes: filename: simple-download-button.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
  * Plugin URI: http://tech.halulu.org/?p=849
  * Author: <a href="http://www.halulu.tech/">Halulu</a>
  * Author URI: http://tech.halulu.org/?p=849
- * Version: 1.0
+ * Version: 1.1
  * Description:ショートコードでダウンロードボタンを表示。DLプログラム付きでソースコードや画像もダウンロードできます。Display CSS3 dwonload bottons by simple Shortcode. This plugin comes with a downloading program that let site visitors donwload source code and images, such as html, php and jpeg.
  */
 
@@ -87,17 +87,15 @@ function disp_downloadButton($atts) {
 			'%plugin_url%',
 			'%file%',
 			'%label%',
-			'%name%',
-			'%download_dir%'
+			'%name%'
 		),
 		array(
 			$style,
 			$plugin_url,
 			$file,
-			$label,
-			$download_dir
+			$label
 		),
-		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%&download_dir=%download_dir%\'"><b>%label%</b></button></div>'
+		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%\'"><b>%label%</b></button></div>'
 	);	
 	
 	return $html;

programming_language: PHP
filename: simple-download-button_dl.php
change_type: ModificationType.MODIFY
diff: @@ -5,9 +5,19 @@
 
 	/* GET param */
 	$filename = $_GET['file'];
-	if(!$filename){ die("ERROR: a file name to download is not set!"); }
-	
-	$download_filepath = $download_dir. $filename;
+		
+	/* Verify file parameter */
+	$fileinfo =	pathinfo($filename);	
+	if(!$fileinfo['filename']){
+		die("ERROR: Downloading filename is not set. Please set the name. the short code should be wriiten like [dlbt file=dummy.html] ");
+	}elseif(!$fileinfo['extension']){
+		die("ERROR: Unappropriate downloading filename: $filename: no extention.");		
+	}
+	if(!preg_match('/^[a-zA-Z0-9_-]/',$fileinfo['filename'])) {
+		die("ERROR: Unappropriate downloading filename: $filename: filename can contains only 'a-z', 'A-Z' '0-9', '-' and '_'");		
+	}
+	// making file path		
+	$download_filepath = $download_dir. $fileinfo['filename']. '.'. $fileinfo['extension'];
 	
 	// set a file name showed in the dialog box.
 	if(!$dispname){$dispname = $filename;}
@@ -15,7 +25,7 @@
 
 	/* set the Content-type depends on the extention */
 	if (!file_exists($download_filepath)) {
-		die("ERROR: There is not shuch file. Please hit the back button to return.");
+		die("ERROR: There is not shuch file at $download_filepath.");
 	}else{
 		$file_info = pathinfo($download_filepath);
 		$ext = strtolower($file_info["extension"]);

programming_language: PHP