Directory Traversal Vulnerabilities in VideoWhisper Live Streaming Integration for WordPress

CVE-2014-1907

Summary

Multiple directory traversal vulnerabilities exist in the VideoWhisper Live Streaming Integration plugin for WordPress, specifically before version 4.29.5. These vulnerabilities enable remote attackers to exploit improperly validated input in the 's' parameter. By leveraging this flaw, attackers can read arbitrary files via a '../' sequence when accessing 'ls/rtmp_login.php', or they can delete arbitrary files by exploiting the same sequence when calling 'ls/rtmp_logout.php'. This presents significant security risks, including unauthorized data access and potential service disruption.

References