FeMiner WMS Directory Traversal Vulnerability in databak.php Component

A directory traversal vulnerability has been identified in FeMiner WMS version 1.0. This vulnerability allows remote attackers to access sensitive information by exploiting the databak.php component. The issue arises from improper handling of file paths, enabling attackers to traverse directories and read arbitrary files, such as the passwd file.

Impact

Exploitation of this vulnerability allows for arbitrary file reading, which could lead to the disclosure of sensitive information stored on the server.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /wms/system/databak.php endpoint. The request must include a 'flag' parameter set to '1' and a 'filename' parameter containing a crafted file path that traverses directories (e.g., '../../../../../../../../etc/passwd'). This will result in the contents of the specified file being returned in the response.