Description
phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint with traversal sequences ../../../../../../ to list and retrieve files outside the intended directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Phptransformer | phpTransformer | 2016.9 | — |
References
- ExploitDB-46192 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: phpTransformer 2016.9 Directory Traversal via jQueryFileUpload third-party-advisory