| शीर्षक | projectsend 35dfd6f08f7d517709c77ee73e57367141107e6b Path Traversal |
|---|
| विवरण | The import-orphans.php page allows administrators to manage files found on the server's upload directory that are not yet tracked in the database. The delete action accepts a files[] array from POST data and constructs a file path by directly concatenating the user-supplied filename with UPLOADED_FILES_DIR
No path normalization (realpath()) or traversal sequence (../) filtering is applied. The resulting path is passed directly to unlink(). An attacker can supply a ../-prefixed filename to escape the upload directory and delete arbitrary files accessible to the web server process.
Unlike the import action in the same file, the delete branch does not call file_is_allowed(), meaning no extension check is enforced either.
POC:
POST /import-orphans.php HTTP/1.1
Host: localhost
Cookie: PHPSESSID=<>
Content-Type: application/x-www-form-urlencoded
action=delete&files[]=../../../../../../../../../../var/www/html/upload/temp/web.config&csrf_token=<> |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1BOWm9FvhmM90oP91rOWpI4GoWdbI06wg/view?usp=sharing |
|---|
| उपयोगकर्ता | 0xNayel (UID 80926) |
|---|
| सबमिशन | 28/02/2026 08:28 AM (7 महीनों पहले) |
|---|
| संयम | 12/03/2026 10:08 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 350656 [projectsend तक r1945 Delete /import-orphans.php realpath files[] निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|