ProjectSend Insecure Direct Object Reference Vulnerability Allowing Unauthorized File Downloads

An insecure direct object reference vulnerability has been identified in ProjectSend version r1605. This vulnerability allows unauthenticated attackers to download private files by manipulating the download ID parameter in the request to process.php. By changing the 'id' parameter to target specific files, attackers can access any user's private files, including those of the admin.

Impact

Exploitation of this vulnerability allows for unauthorized access to private files of any user, including administrative files.

Reproduction

To reproduce this vulnerability, send a GET request to process.php with the 'do' parameter set to 'download' and the 'id' parameter set to the ID of a private file belonging to any user. This can be done using a web browser or a tool like cURL or Postman. The request must include a valid PHP session cookie.