PlayTube 3.0.1 - Information Disclosure

id: CVE-2023-4714

info:
  name: PlayTube 3.0.1 - Information Disclosure
  author: Farish
  severity: high
  description: |
    A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4714
    - https://www.exploitalert.com/view-details.html?id=39826
    - https://vuldb.com/?ctiid.238577
    - https://vuldb.com/?id.238577
    - https://github.com/Threekiii/Awesome-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-4714
    cwe-id: CWE-200
    epss-score: 0.0521
    epss-percentile: 0.91484
    cpe: cpe:2.3:a:playtube:playtube:3.0.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: playtube
    product: playtube
  tags: cve2023,cve,playtube,exposure,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "razorpay_options"
          - "PlayTube"
          - "key:"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - 'key: "([a-z_A-Z0-9]+)"'
# digest: 4a0a0047304502204e7c60aef041a303656ee86baf63a005cb09f57e9cb896f253b2e3ceb7ebf599022100a957cd05e2fa4c205eb22288f1ca874a8de761717341652fc8c96e811632a5d3:922c64590222798bb761d5b6d8e72950