search

SUKOHI / Surpass

A PHP package mainly developed for Laravel to manage uploading images using Ajax and displaying thumbnail.
29 stars 8 forks source link

Vulnerability on image uploads #5

Closed coxw closed 9 years ago

coxw commented 9 years ago

https://github.com/SUKOHI/Surpass/blob/master/src/views/js.blade.php#L181

The folder name of the destination for files can be set in the DOM, and leaves a vulnerability on the site for users uploading images and setting whatever directory they want, and potentially overriding other images. The specific issue relates to where it outputs:

TUName.formData = {"surpass_hidden_dir":"name","surpass_keys":"{\"input\":\"image_upload\",\"preview\":\"preview_images\"}"};

SUKOHI commented 9 years ago

Hi, coxw. I fixed the vulnerability you noticed by checking if a specific directory exists or not and checking the directory is writable.(So, we must make directories we want to save images in advance now.) I wonder this has completely fixed the vulnerability?

If you have some idea, could you inform me of it. Thank you in advance.:)