AllSky Path Traversal Vulnerability Allowing Web Shell Creation and Remote Code Execution

A path traversal vulnerability has been identified in AllSky version 2023.05.01_04. This vulnerability allows an unauthenticated attacker to create a web shell and execute remote code by exploiting the 'path' and 'content' parameters in the '/includes/save_file.php' script.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server where AllSky is running.

Reproduction

To reproduce this vulnerability, send a POST request to '/includes/save_file.php' with the 'path' parameter set to a traversable path and the 'content' parameter containing the code to be executed. The 'path' can be a web alias that the script will resolve to a physical file path on the server.