FileThingie Directory Traversal Vulnerability Allowing Arbitrary File Read

A directory traversal vulnerability has been identified in FileThingie version 2.5.7. This vulnerability allows authenticated remote attackers to read arbitrary files on the server by exploiting improper input sanitization. The issue arises when the application attempts to clean user input in the `$_REQUEST` superglobal but fails to adequately sanitize the `$_GET` superglobal, which is ultimately used in file handling operations. As a result, attackers can craft requests that bypass the sanitization process and access sensitive files through the file download functionality.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive files on the server, including configuration files, source code, and other files readable by the web server user.

Reproduction

To reproduce this vulnerability, an authenticated user can send a GET request to the `ft2.php` file with the `method` parameter set to `getfile` and the `file` parameter containing directory traversal sequences (such as `../`) to navigate the file system. The request must include a valid session cookie to authenticate the user.

Remediation

To address this vulnerability, it is recommended to avoid using `$_GET` directly after sanitizing `$_REQUEST`. Instead, assign sanitized inputs to local variables and use those variables throughout the controller logic. Additionally, implement `basename()` on the file parameter to ensure that only specific files are targeted, stripping away any directory traversal characters.