Description
PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PMB Services | PMB Services | 5.6 | — |
References
- ExploitDB-49054 exploit
- Vendor Homepage product
- Software Download Repository product
- VulnCheck Advisory: PMB 5.6 - 'chemin' Local File Disclosure third-party-advisory