CVE-2018-25311 | BDVDB-2026-329558 Detail
VideoFlowVideoFlow Digital Video Protection
Description#
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.