| عنوان | WebStack-Guns Project (GitHub organization jsnjfz) WebStack-Guns 1.0 (latest master) Path Traversal / Arbitrary File Read (CWE-22) |
|---|
| الوصف | WebStack-Guns 1.0 exposes /kaptcha/{pictureId} as a public endpoint and concatenates the attacker-controlled pictureId directly with the upload directory when reading files. Because no validation or canonicalization is performed, remote attackers can traverse directories and download arbitrary files readable by the service account, leading to high-impact information disclosure. |
|---|
| المصدر | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md |
|---|
| المستخدم | sh7err04 (UID 92493) |
|---|
| ارسال | 10/11/2025 12:47 PM (11 أشهر منذ) |
|---|
| الاعتدال | 30/11/2025 06:05 PM (20 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 333820 [jsnjfz WebStack-Guns 1.0 KaptchaController.java renderPicture اجتياز الدليل] |
|---|
| النقاط | 20 |
|---|