CVE-2020-25540: 
PHP vulnerability analysis and mitigation

ThinkAdmin v6 is affected by a directory traversal vulnerability (CVE-2020-25540) discovered in September 2020. An unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. The vulnerability affects the Update.php controller in the admin API, which contains three functions that can be accessed without authentication (NVD, GitHub Issue).

The vulnerability exists in the Update.php controller's 'get()' function which improperly handles file paths. The function accepts an encoded parameter that after decoding can be used to traverse directories. The application attempts to restrict file access through an allowlist and blocks access to database.php, but these restrictions can be bypassed using path traversal sequences like '../' or using special characters on Windows systems. The vulnerability has a CVSS v3.1 base score of 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD).

A successful exploitation allows an unauthenticated attacker to read arbitrary files from the server's filesystem. This could lead to exposure of sensitive information including configuration files, source code, and other critical system files (NVD, WTFSec).

The vulnerability is easily exploitable as it requires no authentication and can be triggered through HTTP GET requests. Proof-of-concept exploits have been publicly disclosed, demonstrating both directory listing and arbitrary file reading capabilities. The vulnerability can be exploited by sending specially crafted requests to the admin/api.Update/node endpoint for directory listing and admin/api.Update/get endpoint for file reading (GitHub Issue, WTFSec).

Users should upgrade to a version newer than 2020.08.03.01. The vulnerability was fixed by implementing proper input validation and path traversal checks (NVD).