PMB Local File Disclosure Vulnerability in getgif.php

A local file disclosure vulnerability has been identified in PMB version 5.6. The issue arises in the getgif.php file, where the 'chemin' parameter is not properly sanitized. This flaw allows attackers to read arbitrary system files by sending crafted requests to the getgif.php endpoint. Exploitation of this vulnerability could lead to the disclosure of sensitive files, such as /etc/passwd.

Impact

Exploitation of this vulnerability allows for arbitrary file reading, potentially disclosing sensitive system information.

Reproduction

To reproduce this vulnerability, send a request to the getgif.php endpoint with a crafted 'chemin' parameter that includes a path traversal sequence. This will exploit the lack of input sanitization to access restricted files on the server.