> For the complete documentation index, see [llms.txt](https://kos0ng.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kos0ng.gitbook.io/notes/research/2023/cve-2023-0316.md).
# CVE-2023-0316
Local File Read through Improper Filename Validation
## Vulnerability Explanation
This vulnerability occur because there is no filename **validation** on **logo\_image\_login** and **logo\_image\_header** on import and export function. Attacker can use path traversal payload to **read local file** such as /etc/passwd or froxlor config file.
## Vulnerability Type
* Local File Read
## CVSS
* [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N](https://nvd.nist.gov/vuln/detail/CVE-2023-0316) (Medium)
## Vendor
* [froxlor](https://www.froxlor.org/)
## Affected Version
* froxlor version **0.10.38.3** until **2.x**
## Proof of Concept
1. Go to import function on **"Settings"**
2.
```
```
3. Modify filename on **logo\_image\_login** or **logo\_image\_header** with **path traversal** payload , e.g `"../../../../../etc/passwd?v=1672300384"`
4.
```
```
5. After successfully imported file, go to **"Settings"** and go to **Export page**
6.
```
```
7. Click **Download**/**Export** Settings, then leaked file will be on **panel.logo\_image\_login.image\_data** key on json file in **base64** encoded format
8.
```
```
## Exploit Code
```python
# TBU
```
## Tested On
* froxlor version: **2.0.0-beta1**
## Disclosure Timeline
* **2022-12-29:** Vulnerability discovered.
* **2023-12-31:** Vulnerability fixed.
* **2023-01-14:** Vulnerability reported to the MITRE corporation.
* **2023-01-14:** CVE has been assigned.
* **2023-01-16:** Public disclosure of the vulnerability.
## Researcher
* Achmad Zaenuri Dahlan Putra ([kos0ng](https://github.com/kos0ng))
## Additional Information
*
*