kalcaddle kodbox Path Traversal Vulnerability in File Output Function

A path traversal vulnerability has been identified in kalcaddle kodbox versions through 1.61.09. The issue arises in the fileOut function within 'app/controller/explorer/index.class.php', where user-controlled input is not properly sanitized before being used to access files on the server. This vulnerability can be exploited remotely, allowing attackers to read arbitrary files from the system.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could lead to exposure of sensitive information on the server.

Reproduction

To reproduce this vulnerability, send a GET request to the application with the 'explorer/index/fileOut' path and include a 'path' parameter with a value that specifies a file to read, such as '/etc/passwd'. Ensure that the request includes a valid session cookie and CSRF token.