WebsiteBaker Directory Traversal Vulnerability Allowing Arbitrary File Deletion

A directory traversal vulnerability has been identified in WebsiteBaker version 2.13.3. This vulnerability allows authenticated attackers to delete arbitrary files by manipulating directory path parameters. Exploitation involves sending crafted GET requests to the '/admin/media/delete.php' endpoint, using directory traversal sequences to target files outside the intended directory.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server.

Reproduction

To reproduce this vulnerability, send a GET request to '/admin/media/delete.php' with a 'dir' parameter that includes directory traversal sequences. This will allow deletion of files outside the default directory.