| 标题 | David-Crty Databasement >= 1.2.0, < 1.7.2 Path Traversal |
|---|
| 描述 | A path traversal vulnerability was identified in the SQLite restore functionality of Databasement, an open-source Laravel-based database backup management platform. The schema_name parameter in the restore API endpoint (POST /api/v1/database-servers/{id}/restore) accepts arbitrary file paths without validation. When restoring a SQLite snapshot, the application uses PHP's copy() function to write the snapshot file to the path specified by schema_name. An authenticated user with Member, Admin, or Demo role can supply a traversal path (e.g., /app/public/shell.php) to write a malicious SQLite file — containing embedded PHP code in a text column — to the web root, achieving remote code execution as the application user. The vulnerability exists because the SQLite database type validation rules only enforce 'required', 'string', 'max:255' without any path restriction, while other database types (MySQL, PostgreSQL) enforce a strict alphanumeric regex. The application has a SafePath validation rule used elsewhere but it was not applied to the SQLite restore schema_name parameter. The vulnerability is present in both the API (DatabaseServerController) and Livewire (Restore Modal) restore flows. Patched in version 1.7.2 by adding path validation to reject absolute paths and directory traversal sequences. |
|---|
| 来源 | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww |
|---|
| 用户 | ByteJMP (UID 99294) |
|---|
| 提交 | 2026-09-03 04時39分 (28 日前) |
|---|
| 管理 | 2026-09-30 21時07分 (28 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 412345 [David-Crty databasement 直到 1.7.1 database-servers API Endpoint RestoreRequest.php schema_name 目录遍历] |
|---|
| 积分 | 20 |
|---|