deblan-mirror/tinyfilemanager
deblan-mirror/tinyfilemanager
1
0
Fork 0
mirror of https://github.com/prasathmani/tinyfilemanager synced 2024-04-25 02:40:30 +02:00
Code Issues Projects Releases Wiki Activity

Patched the RCE (#636)

Browse source 
I have patched the file upload directory traversal to Authenticated Remote Code Execution Vulnerability.
This commit is contained in:
febinrev 2021-11-12 08:31:02 +05:30 committed by GitHub
parent c1718ff4c5
commit 2046bbde72
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
tinyfilemanager.php
View file

@ -880,7 +880,7 @@ if (!empty($_FILES) && !FM_READONLY) {
$targetPath = $path . $ds;
if ( is_writable($targetPath) ) {
$fullPath = $path . '/' . $_REQUEST['fullpath'];
$fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
$folder = substr($fullPath, 0, strrpos($fullPath, "/"));
if(file_exists ($fullPath) && !$override_file_name) {