Navigate CMS Path Traversal Vulnerability in File Download Feature

A path traversal vulnerability has been identified in Navigate CMS version 2.8.5. This vulnerability allows authenticated users to download arbitrary files by injecting directory traversal sequences into the 'id' parameter. Exploitation involves sending GET requests to 'navigate_download.php' with payloads that traverse directories, such as '../../../cfg/globals.php', to access sensitive configuration and system files outside the intended directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, including configuration and system files, which could be leveraged for further attacks.

Reproduction

To reproduce this vulnerability, an authenticated user can send a GET request to 'navigate_download.php' with the 'id' parameter set to a path traversal payload. The server response will include the contents of the requested file, demonstrating the successful exploitation of the vulnerability.