Directory Traversal in Reportico Web via run.php

Executive Summary

This is a directory traversal vulnerability in reportico-web versions 8.1.0 and earlier. It allows remote attackers to access or execute arbitrary PHP files on the web server by manipulating the target_format parameter combined with execute_mode=EXECUTE in the run.php endpoint. Attackers can specify a directory traversal path to a PHP file without including the file extension.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Reportico-web version is 8.1.0 or earlier. Test by accessing the run.php endpoint with crafted parameters like target_format=../../../../etc/passwd and execute_mode=EXECUTE. If the server responds with sensitive files or executes unintended PHP files, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive files, execute malicious PHP code, or gain unauthorized access to the server. This could lead to data breaches, system compromise, or further network infiltration depending on the server's configuration and permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Reportico-web to a version beyond 8.1.0 if available. If no patch exists, restrict access to the run.php endpoint via web server rules or disable it entirely. Monitor network traffic for suspicious requests targeting this parameter combination.

Useful 0 Not Useful 0