This host is installed with Wordpress Html5 Mp3 Player with Playlist plugin and is prone to path disclosure vulnerability.

Successful exploitation will allow remote attackers to discloses the software's installation path resulting in a loss of confidentiality. Impact Level: Application

Upgrade to version 2.7 or higher, For updates refer https://wordpress.org/plugins/html5-mp3-player-with-playlist

Flaw is triggered when a remote attacker sends a direct request for the /html5plus/playlist.php script.

Wordpress HTML5 MP3 Player with Playlist Free plugin before 2.7

Send a crafted data via HTTP GET request and check whether it is disclosing installation path or not.

• http://h4x0resec.blogspot.in/2014/11/wordpress-html5-mp3-player-with.html
• http://packetstormsecurity.com/files/129286
• http://www.osvdb.org/115159
• http://xforce.iss.net/xforce/xfdb/98988
• https://wordpress.org/plugins/html5-mp3-player-with-playlist/changelog

---

Updated on 2015-03-25