ScaffoldHub arbitrary file read vulnerability

When conducting a security code audit for one my clients, I found an arbitrary file read due to path traversal in scaffoldhub, the vulnerability is in the local file storage strategy.

I have fixed the vulnerability for my client since it was my first priority and then I responsibly disclosed this vulnerability to Felipe Lima the owner of the project on discord who acted quickly and in less than 2 hours patched [1] the issue and emailed his clients about the fix.

Felipe also kindly gave me a developer subscription to scaffoldhub so I guess I'm obliged to use it for my next web project!


[1] Felipe's patch: https://gist.github.com/felipepastorelima/46e78f4201c2efc803c276d0da0fc211

Comments

  1. Bet365 Casino Review for Canadian Players | 100% Bonus up to C$1600
    If 라스 벳 you 아시안부키 have ever tried out Bet365 casino for 원피스 바카라 your personal money and want to get started 7 포커 with a little bit of action and win a nice bonus, then you must know what you 🏆 Bet365 Casino: Claim 라이브채팅 Bonus🎁 Free Spins: Up to C$1000💻 Software provider: NetEnt, ‎Microgaming‎, ‎PayPal‎

    ReplyDelete
  2. BetMGM casino set to open in Arizona | KTNV
    Sports betting is now 밀양 출장샵 live in Arizona, with a sportsbook opening at 군산 출장마사지 BetMGM Casino Wynn and 서산 출장샵 Encore 제주 출장안마 are the current 수원 출장샵

    ReplyDelete
  3. Casino - Tricktoactoe
    Welcome to the hottest slots online, you are always going to find 슬롯 사이트 a good casino where you can play 스마일 토토 for real money without ever having to 사설토토 졸업 샤오미 pay any Nov 1, 2016 · 먹튀 신고 Uploaded by Big Time Gaming 파워볼 밸런스 사이트 벳무브

    ReplyDelete
  4. Casino de Monte-Carlo, Monaco | FilmfileEurope
    Casino de 토토사이트 검증 샤오미 Monte-Carlo, Monaco. Casino de Monte-Carlo, Monaco. 아이탬매니아 Theatre of this film was 스포츠토토 사이트 샤오미 established in 1989 스포츠토토 언오버 비코리아 놀검소 and the film is based 엠 오엠 on a fictional tale.

    ReplyDelete
  5. In this thrilling multi-wheel recreation, 12 individual and synchronised Auto Roulette wheels spin virtually continuously, with the balls dropping one after the opposite in the totally different wheels. Our Live American Roulette provides further alternative and selection to ourRoulette line up. This double-zero variant provides further excitement for gamers, together with not solely the 1–36 and nil , but additionally an additional double-zero number on the wheel 우리카지노 and desk structure. Use the won Gold Bars in any of the long run} rounds to increase your chances of successful a ground-breaking payout by stacking {multiple|a number of} Gold Bars collectively onto your lucky betting spot. Enjoy free slots, blackjack, roulette and video poker from the top software makers with no sign up needed.

    ReplyDelete
  6. You can even set the foundations so that gamers can not exit of dafabet the sport on energy cards, or "muscle" cards, as some wish to call them. If a participant surrenders, they forfeit the hand, however get to maintain half their money. This is an effective strategy if the participant is dealt 15 and the supplier has a 10-point card showing, for example. Collect half their bet and leave their cards on the table. Ask the participant in the event that they} wish to hit, stand, double down, or surrender.

    ReplyDelete

Post a Comment