Vulnerability: Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via a .. (dot dot) in the file parameter.
Vulnerability ID: CVE-2013-5984
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/microweber/microweber
Published: 2014-05-12
File: src/Microweber/Utils/Backup.php
Commit message: fix of CVE HTB23175
https://www.htbridge.com/advisory/HTB23175
Commit author: Peter Ivanov

Vulnerable version (before fix):
 function download($params)         if (!is_admin()) {             error("must be admin");         }         ;         ini_set('memory_limit', '512M');         set_time_limit(0);  function download($params)         } else if (isset($_GET['file'])) {             $id = $params['file'];         }          // Check if the file has needed args         if ($id == NULL) { function download($params)         // Generate filename and set error variables          $filename = $here . $id;         if (!is_file($filename)) {             return array('error' => "You have not provided a existising filename to download.");  function download($params)      function readfile_chunked($filename, $retbytes = TRUE)     {         $chunk_size = 1024 * 1024;         $buffer = "";         $cnt = 0; function readfile_chunked($filename, $retbytes = TRUE)         if ($handle === false) {             return false;         }         while (!feof($handle)) {             $buffer = fread($handle, $chunk_size);             echo $buffer;

Fixed version (after fix):
 function download($params)         if (!is_admin()) {             error("must be admin");         }          ini_set('memory_limit', '512M');         set_time_limit(0);  function download($params)         } else if (isset($_GET['file'])) {             $id = $params['file'];         }         $id = str_replace('..', '', $id);           // Check if the file has needed args         if ($id == NULL) { function download($params)         // Generate filename and set error variables          $filename = $here . $id;         $filename = str_replace('..','',$filename);         if (!is_file($filename)) {             return array('error' => "You have not provided a existising filename to download.");  function download($params)      function readfile_chunked($filename, $retbytes = TRUE)     {           $filename = str_replace('..','',$filename);          $chunk_size = 1024 * 1024;         $buffer = "";         $cnt = 0; function readfile_chunked($filename, $retbytes = TRUE)         if ($handle === false) {             return false;         }             while (!feof($handle)) {             $buffer = fread($handle, $chunk_size);             echo $buffer;

Patch:
patch: @@ -1496,7 +1496,7 @@ function download($params)
         if (!is_admin()) {
             error("must be admin");
         }
-        ;
+
         ini_set('memory_limit', '512M');
         set_time_limit(0);
 
@@ -1507,6 +1507,8 @@ function download($params)
         } else if (isset($_GET['file'])) {
             $id = $params['file'];
         }
+        $id = str_replace('..', '', $id);
+
 
         // Check if the file has needed args
         if ($id == NULL) {
@@ -1519,6 +1521,7 @@ function download($params)
         // Generate filename and set error variables
 
         $filename = $here . $id;
+        $filename = str_replace('..','',$filename);
         if (!is_file($filename)) {
             return array('error' => "You have not provided a existising filename to download.");
 
@@ -1542,6 +1545,10 @@ function download($params)
 
     function readfile_chunked($filename, $retbytes = TRUE)
     {
+
+
+        $filename = str_replace('..','',$filename);
+
         $chunk_size = 1024 * 1024;
         $buffer = "";
         $cnt = 0;
@@ -1550,6 +1557,10 @@ function readfile_chunked($filename, $retbytes = TRUE)
         if ($handle === false) {
             return false;
         }
+
+
+
+
         while (!feof($handle)) {
             $buffer = fread($handle, $chunk_size);
             echo $buffer;
path: src/Microweber/Utils/Backup.php