CVE-2018-20525
CRITICALRoxy Fileman 1.4.5 - Path Traversal via copydir.php, copyfile.php, and fileslist.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-20525. PoCs published by Pongtorn Angsuchotmetee_ Vittawat Masaree.
AI-analyzed exploit summary The exploit demonstrates path traversal and unrestricted file upload vulnerabilities in Roxy Fileman 1.4.5. Path traversal allows accessing arbitrary files via manipulated variables in copydir.php, copyfile.php, and fileslist.php. Unrestricted file upload enables uploading malicious files with double extensions (e.g., shellcode.php.png) if php.ini is configured with AddHandler php7-script .php.
Description
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
Exploits (1)
The exploit demonstrates path traversal and unrestricted file upload vulnerabilities in Roxy Fileman 1.4.5. Path traversal allows accessing arbitrary files via manipulated variables in copydir.php, copyfile.php, and fileslist.php. Unrestricted file upload enables uploading malicious files with double extensions (e.g., shellcode.php.png) if php.ini is configured with AddHandler php7-script .php.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N