EasyImages2.0 arbitrary file download vulnerability

[sunset-move]

EasyImages2.0 arbitrary file download vulnerability

Found on: 2022-12-27

Impact version

EasyImages2.0 ≤ v2.6.7

Analysis Report：

Vulnerability path: /application/down.php

You can download any file in the host by passing the dw parameter to the get request

Fixes

Specify the download directory to download only for the specified directory, other directories are filtered and requests are rejected.

[icret]

Thanks for your feedback, I will repair it in time!