FileThingie Path Traversal Vulnerability Leading to Arbitrary File Write

A path traversal vulnerability has been identified in FileThingie version 2.5.7, allowing remote attackers to manipulate file paths and write sensitive information to arbitrary locations on the server. The issue arises in the 'ft2.php' component, where inadequate validation of directory traversal sequences ('../') enables exploitation.

Impact

Exploitation of this vulnerability allows for arbitrary file writing, with the potential for remote code execution if a malicious PHP web shell is uploaded and moved to a web-accessible directory.

Reproduction

To reproduce this vulnerability, first upload a file named 'audit.txt' to the current working directory using the FileThingie interface. Then, send a POST request to 'ft2.php' with the 'act' parameter set to 'move', the 'file' parameter set to 'audit.txt', the 'dir' parameter containing a long sequence of slashes to inflate the path, and the 'newvalue' parameter set to traverse out of the restricted directory and into a writable location, such as '/tmp'.

Remediation

Path validation should be improved by using PHP's 'realpath()' function to ensure directories are correctly normalized and do not allow traversal outside of intended boundaries. Additionally, consecutive slashes should be sanitized from user input before processing.