search

trampgeek / jobe

jobe is a server that runs small programming jobs in a variety of programming languages
MIT License
111 stars 80 forks source link

Privilege escalation using sourcefilename #46

Closed myyxl closed 3 years ago

myyxl commented 3 years ago

Hi Richard, I have found another privilege escalation but this time using the sourcefilename. When adding "../../" before the actual file name you can store the file in another directory. If you store the file into the web directory you can execute php code by doing a request to the website. After this you can patch runguard and gain root. Here is the affected line in the source code: Link

Sincerely, Marlon

trampgeek commented 3 years ago

Thanks again Marlon. Hopefully fixed now (version 1.6.5).