Executive Summary

phpFileManager version 1.7.8 contains a Local File Inclusion (LFI) vulnerability that allows unauthenticated attackers to read arbitrary files on the server.

This vulnerability arises because the application does not properly validate or sanitize the parameters action, fm_current_dir, and filename in the index.php file.

Attackers can send crafted GET requests manipulating these parameters to access sensitive files such as /etc/passwd.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server without any authentication.

By accessing files like /etc/passwd, attackers can gather critical system information which may aid in further attacks or compromise.

The exposure of sensitive data can lead to information disclosure, potentially harming the confidentiality of your system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending crafted HTTP GET requests to the vulnerable phpFileManager's index.php endpoint, manipulating the parameters action, fm_current_dir, and filename to attempt to read sensitive files."}, {'type': 'paragraph', 'content': 'A typical detection command using curl would be:'}, {'type': 'list_item', 'content': 'curl "http://target/index.php?action=3&fm_current_dir=/etc/&filename=passwd"'}, {'type': 'paragraph', 'content': 'If the response contains the contents of the /etc/passwd file or other sensitive files, the system is vulnerable.'}, {'type': 'paragraph', 'content': 'Additionally, a proof-of-concept Python script exists that automates this detection by sending crafted requests and displaying file contents.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0