Vulnerability · Published Mar 30, 2023 · Assigned by VulDB
CVE-2023-1745KMPlayer SHFOLDER.dll uncontrolled search path
Medium 5.3
In plain English
A medium-severity uncontrolled search path in KMPlayer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.
Affected products (as reported)
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://vuldb.com/?id.224633 vdb-entry, technical-description
- https://vuldb.com/?ctiid.224633 signature, permissions-required
- https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Poc exploit
- https://drive.google.com/file/d/1bdYaDmtWhnjaHkzv3bZ4PUSMzDJ8JjSV/view exploit
- https://youtu.be/7bh2BQOqxFo media-coverage