Lucene search
K

PlayTube 3.0.1 Information Disclosure Vulnerability

🗓️ 04 Sep 2023 00:00:00Reported by CraCkErType 
zdt
 zdt
🔗 0day.today👁 295 Views

PlayTube 3.0.1 Information Disclosure Vulnerability. Sensitive data leakage via redirect response

Related
Code
ReporterTitlePublishedViews
Family
Circl
CVE-2023-4714
2 Sep 202300:14
circl
CNNVD
PlayTube Information Disclosure Vulnerability
1 Sep 202300:00
cnnvd
CVE
CVE-2023-4714
1 Sep 202320:00
cve
Cvelist
CVE-2023-4714 PlayTube Redirect information disclosure
1 Sep 202320:00
cvelist
Nuclei
PlayTube 3.0.1 - Information Disclosure
4 Jun 202603:48
nuclei
NVD
CVE-2023-4714
1 Sep 202320:15
nvd
OSV
CVE-2023-4714
1 Sep 202320:15
osv
Packet Storm
PlayTube 3.0.1 Information Disclosure
2 Sep 202300:00
packetstorm
Prion
Information disclosure
1 Sep 202320:15
prion
Positive Technologies
PT-2023-30335 · Playtube · Playtube
1 Sep 202300:00
ptsecurity
Rows per page
# Exploit Title: PlayTube 3.0.1 - Redirect Information Disclosure
# Exploit Author: CraCkEr
# Vendor: PlayTube
# Vendor Homepage: https://playtubescript.com/
# Software Link: https://demo.playtubescript.com/
# Tested on: Windows 10 Pro
# Impact: Sensitive Information Leakage
# CVE: CVE-2023-4714
# CWE: CWE-200 - CWE-284 - CWE-266


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

Information disclosure issue in the redirect responses, When accessing any page on the website,
Sensitive data, such as app IDs, is being exposed in the body of these redirects.


## Steps to Reproduce:

When you visit most of pages on the website, such as the index page for example:

https://website/

in the body page response there's information leakage for "RazorPay Payment" id KEY

+--------------------------------------+
razorpay_options = {
          key: "rzp_test_ruz***********"
+--------------------------------------+


Note: The same information leaked, for the app ID KEY, was added to the "Payment Configuration" in the Administration Panel

Settings of "Payment Configuration" in the Administration Panel, on this Path:

https://website/admin-cp/payment-settings


[-] Done

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation