phpTransformer Directory Traversal Vulnerability

A directory traversal vulnerability has been identified in phpTransformer version 2016.9. This vulnerability allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Exploitation involves sending requests to the jQueryFileUploadmaster server endpoint with traversal sequences to list and retrieve files outside the intended directory.

Impact

Exploitation of this vulnerability allows for unauthorized access to files on the server, which could include sensitive information or application configuration.

Reproduction

To reproduce this vulnerability, send a request to the jQueryFileUploadmaster server endpoint's php index.php file, including a path parameter that uses directory traversal sequences to navigate outside the intended directory. The server response will include a list of files accessed through the traversal.