cve/2021/CVE-2021-39316.md

CVE-2021-39316

Description

The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsap_download action using directory traversal in the link parameter.

POC

Reference

• http://packetstormsecurity.com/files/165146/WordPress-DZS-Zoomsounds-6.45-Arbitrary-File-Read.html

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/HimmelAward/Goby_POC
• https://github.com/NyxAzrael/Goby_POC
• https://github.com/UrielYochpaz/Exploit-WordPress-Plugin-DZS-Zoomsounds
• https://github.com/Z0fhack/Goby_POC
• https://github.com/anggoroexe/Mass_CVE-2021-39316
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/soosmile/POC