search

EyesOfNetworkCommunity / eonweb

EyesOfNetwork web interface
8 stars 12 forks source link

/module/admin_conf/download.php $_GET["file"] variable exists arbitrary file download vulnerability #8

Closed hi-KK closed 6 years ago

hi-KK commented 7 years ago

Hello, I found that there are some problems with eonweb, hoping to help you and your work /module/admin_conf/download.php

if(isset($_GET["file"])){
    $dwn="/tmp/".$_GET["file"];
    header("Content-type: application/octet-stream");
    header("Content-Disposition: attachment; filename=".$_GET["file"]);
    flush(); 
    readfile($dwn);
}

'$_GET["file"]' is not filtered,and exists arbitrary file download vulnerability So when we open this url: https://localhost/module/admin_conf/download.php?file=../../etc/passwd it would download the file '/etc/passwd'

1

and we can get the contents of this file

2
jeanphilippelevy commented 7 years ago

Fix here : 3163221240db69d417cf6bb8456f87653d472f21

Thank you for the advice !