| 제목 | David-Crty Databasement >= 1.2.0, < 1.7.2 Path Traversal |
|---|
| 설명 | A path traversal vulnerability was identified in the SQLite restore functionality of Databasement, an open-source Laravel-based database backup management platform. The schema_name parameter in the restore API endpoint (POST /api/v1/database-servers/{id}/restore) accepts arbitrary file paths without validation. When restoring a SQLite snapshot, the application uses PHP's copy() function to write the snapshot file to the path specified by schema_name. An authenticated user with Member, Admin, or Demo role can supply a traversal path (e.g., /app/public/shell.php) to write a malicious SQLite file — containing embedded PHP code in a text column — to the web root, achieving remote code execution as the application user. The vulnerability exists because the SQLite database type validation rules only enforce 'required', 'string', 'max:255' without any path restriction, while other database types (MySQL, PostgreSQL) enforce a strict alphanumeric regex. The application has a SafePath validation rule used elsewhere but it was not applied to the SQLite restore schema_name parameter. The vulnerability is present in both the API (DatabaseServerController) and Livewire (Restore Modal) restore flows. Patched in version 1.7.2 by adding path validation to reject absolute paths and directory traversal sequences. |
|---|
| 원천 | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww |
|---|
| 사용자 | ByteJMP (UID 99294) |
|---|
| 제출 | 2026. 09. 03. AM 04:39 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 30. PM 09:07 (28 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 412345 [David-Crty databasement 까지 1.7.1 database-servers API Endpoint RestoreRequest.php schema_name 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|