Summary
Insecure Temporary File vulnerability in php/import.php allows remote attackers to read users' private flight data from the temporary files.
Details
The uploaded flight data is persistently stored in a "temporary" file that is visible to everyone if the filename is known. The filename is displayed to the user, and the user is encouraged to post the filename in public:
|
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadFile)) { |
|
echo "<b>" . _("Upload successful. Parsing...") . "</b><br><h4>" . _("Results") . "</h4>"; |
|
flush(); |
|
print "Tmpfile <tt>" . basename($_FILES['userfile']['tmp_name']) . "</tt><br>"; // DEBUG |
|
<p><?php echo _("If anything else goes wrong during importing, or if a current airline is being mapped wrong, it's a bug and we'd like to know about it. <a href=\"/about\">Drop us a line</a>, tell us exactly what went wrong, and (this is important) <i>give the \"Tmpfile\" value from the top of the import page</i>, so we can replicate it."); ?></p> |
The filename is relatively short so it is also possible to use brute-force to find the filenames.
PoC
A user posted their tmpfile name in an issue #1443, and it can be downloaded at https://openflights.org/import/php35doLd.
Impact
Attackers can access users' private flight data by searching for "tmpfile" in public issues, or brute-forcing the filename.
Summary
Insecure Temporary File vulnerability in
php/import.phpallows remote attackers to read users' private flight data from the temporary files.Details
The uploaded flight data is persistently stored in a "temporary" file that is visible to everyone if the filename is known. The filename is displayed to the user, and the user is encouraged to post the filename in public:
openflights/php/import.php
Lines 336 to 339 in f53e452
openflights/faq.php
Line 140 in f53e452
The filename is relatively short so it is also possible to use brute-force to find the filenames.
PoC
A user posted their tmpfile name in an issue #1443, and it can be downloaded at https://openflights.org/import/php35doLd.
Impact
Attackers can access users' private flight data by searching for "tmpfile" in public issues, or brute-forcing the filename.