Description
ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to < 5.5.3-#197affected5.5.3-#197unaffected
pkg:github/MacWarrior/clipbucket-v5References
- https://hackmd.io/@leediay/S1AIRjzqfx ↗
- https://github.com/MacWarrior/clipbucket-v5/commit/f31de49b2194482ffef7147aa1e9b1c8f0f04eb7 ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/61cce55ab26ef88fb782dfde47b44c17c56978cd/upload/admin_area/template_editor.php#L44-L69 ↗
- https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23197 ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-197-path-traversal-via-template-editor-php ↗