CVE-2020-10459

Name of the Vulnerable Software and Affected Versions Chadha PHPKB Standard Multi-Language version 9

Description The issue allows attackers to list files stored on the web server by exploiting a Path Traversal vulnerability in the admin/assetmanager/assetmanager.php file, specifically through the inpCurrFolder parameter in a POST request. This is made possible by using a dot-dot-slash sequence (../) to traverse the directory.

Recommendations For Chadha PHPKB Standard Multi-Language version 9, as a temporary workaround, consider restricting access to the admin/assetmanager/assetmanager.php file until a patch is available. Additionally, restrict the use of the inpCurrFolder parameter to prevent directory traversal attacks.