| タイトル | PMWeb v7.x, v8.x, v2025.x Path Traversal / Arbitrary File Read |
|---|
| 説明 | A vulnerability was identified in the Downloader component (downloader.aspx) of PMWEB Project Management Platform. The endpoint accepts the FullFileName and FileName request parameters as raw file system paths without applying any validation, allowlisting, or path restriction.
As a result, a requester is able to supply an arbitrary file path and retrieve files from any folder on the server, rather than being limited to the operational files the Downloader was intended to serve. This allows unauthorized disclosure of any file accessible to the web application process, including configuration files, source code, and other sensitive server-side resources.
POC Steps
1. Identify a PMWEB server exposing the downloader.aspx endpoint.
2. Send a request to downloader.aspx supplying a FullFileName parameter containing a path to a file outside the intended operational directory (e.g., a system or application configuration file).
3. Observe that the server returns the requested file content without validating that the path falls within an authorized directory.
4. Repeat with different file paths to confirm files from arbitrary folders on the server can be retrieved.
Credits
The following individuals and organizations are credited for the discovery and coordination of these findings:
● Abdullah AlJaber
● Abdulmajeed AlDayel
● Mohammad AlHumaid
● Saudi Arabia National Cybersecurity Authority (NCA)
● Saudi Information Technology Company (SITE) |
|---|
| ユーザー | aljaber (UID 99098) |
|---|
| 送信 | 2026年08月15日 02:22 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 20:47 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410954 [PMWeb 7.x/8.x/2025.x downloader.aspx FullFileName/FileName ディレクトリトラバーサル] |
|---|
| ポイント | 17 |
|---|