EasyPHP Webserver Path Traversal Vulnerability Allowing Access to Sensitive Files

A path traversal vulnerability has been identified in EasyPHP Webserver version 14.1. This vulnerability allows remote users with low privileges to bypass SecurityManager restrictions and access files outside the document root. Exploitation involves sending GET requests with encoded directory traversal sequences, such as /..%5c..%5c, to read system files like /windows/win.ini.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system files, potentially allowing for further exploitation or information disclosure.

Reproduction

To reproduce this vulnerability, send a GET request to the server with an encoded directory traversal sequence that bypasses the document root restrictions. The request should target the EasyPHP Webserver 14.1 instance.