Xerte Online Toolkits Path Traversal via connector.php

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

对路径名的限制不恰当(路径遍历)

Xerte Online Toolkits 路径遍历漏洞

Xerte Online Toolkits是英国Xerte公司的一个在线学习内容制作平台。 Xerte Online Toolkits 3.15及之前版本存在路径遍历漏洞，该漏洞源于/editor/elfinder/php/connector.php端点的elFinder连接器存在相对路径遍历，重命名命令中的name参数未清理路径遍历序列，攻击者可提供包含目录遍历序列的名称值，将文件从项目媒体目录移动到文件系统任意位置，可能覆盖应用程序文件，实现存储型跨站脚本，或结合其他漏洞通过移动PHP代码文件到应用程

N/A

N/A