| 제목 | PMWeb v7.x, v8.x, v2025.x Path Traversal / Arbitrary File Read |
|---|
| 설명 | A vulnerability was identified in the Downloader component (downloader.aspx) of PMWEB Project Management Platform. The endpoint accepts the FullFileName and FileName request parameters as raw file system paths without applying any validation, allowlisting, or path restriction.
As a result, a requester is able to supply an arbitrary file path and retrieve files from any folder on the server, rather than being limited to the operational files the Downloader was intended to serve. This allows unauthorized disclosure of any file accessible to the web application process, including configuration files, source code, and other sensitive server-side resources.
POC Steps
1. Identify a PMWEB server exposing the downloader.aspx endpoint.
2. Send a request to downloader.aspx supplying a FullFileName parameter containing a path to a file outside the intended operational directory (e.g., a system or application configuration file).
3. Observe that the server returns the requested file content without validating that the path falls within an authorized directory.
4. Repeat with different file paths to confirm files from arbitrary folders on the server can be retrieved.
Credits
The following individuals and organizations are credited for the discovery and coordination of these findings:
● Abdullah AlJaber
● Abdulmajeed AlDayel
● Mohammad AlHumaid
● Saudi Arabia National Cybersecurity Authority (NCA)
● Saudi Information Technology Company (SITE) |
|---|
| 사용자 | aljaber (UID 99098) |
|---|
| 제출 | 2026. 08. 15. AM 02:22 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. PM 08:47 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410954 [PMWeb 7.x/8.x/2025.x downloader.aspx FullFileName/FileName 디렉토리 순회] |
|---|
| 포인트들 | 17 |
|---|