| शीर्षक | David-Crty Databasement >= 1.2.0, < 1.7.2 Path Traversal |
|---|
| विवरण | A path traversal vulnerability was identified in the SQLite restore functionality of Databasement, an open-source Laravel-based database backup management platform. The schema_name parameter in the restore API endpoint (POST /api/v1/database-servers/{id}/restore) accepts arbitrary file paths without validation. When restoring a SQLite snapshot, the application uses PHP's copy() function to write the snapshot file to the path specified by schema_name. An authenticated user with Member, Admin, or Demo role can supply a traversal path (e.g., /app/public/shell.php) to write a malicious SQLite file — containing embedded PHP code in a text column — to the web root, achieving remote code execution as the application user. The vulnerability exists because the SQLite database type validation rules only enforce 'required', 'string', 'max:255' without any path restriction, while other database types (MySQL, PostgreSQL) enforce a strict alphanumeric regex. The application has a SafePath validation rule used elsewhere but it was not applied to the SQLite restore schema_name parameter. The vulnerability is present in both the API (DatabaseServerController) and Livewire (Restore Modal) restore flows. Patched in version 1.7.2 by adding path validation to reject absolute paths and directory traversal sequences. |
|---|
| स्रोत | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww |
|---|
| उपयोगकर्ता | ByteJMP (UID 99294) |
|---|
| सबमिशन | 03/09/2026 04:39 AM (28 दिन पहले) |
|---|
| संयम | 30/09/2026 09:07 PM (28 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 412345 [David-Crty databasement तक 1.7.1 database-servers API Endpoint RestoreRequest.php schema_name निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|