Listen to this Post
The vulnerability occurs in the `/var/tdf/download_setting.php` endpoint of Mozart FM Transmitter devices running affected firmware versions. This PHP script uses the `$_GET[‘filename’]` parameter to construct file paths by directly concatenating user input with a forced `.tgz` extension. The system operates on PHP version 5.3.2, which is prior to PHP 5.3.4. In PHP versions before 5.3.4, null bytes (represented as %00 in URLs) are not properly sanitized and are treated as string terminators by underlying C functions. When an attacker supplies a filename parameter with directory traversal sequences and a null byte, such as ../../../../etc/passwd%00, the concatenated string becomes ../../../../etc/passwd%00.tgz. However, during file operations like fopen(), the null byte terminates the string, ignoring the appended `.tgz` extension. This allows the attacker to bypass the intended file extension restriction and traverse the file system. Since no authentication is required to access this endpoint, an unauthenticated remote attacker can exploit this flaw to read arbitrary files accessible to the web server user. This includes sensitive system files like /etc/passwd, configuration files, or log files. The vulnerability stems from improper input validation and the use of an outdated, vulnerable PHP version that does not mitigate null byte injection attacks. Exploitation is straightforward via crafted HTTP GET requests, leading to unauthorized information disclosure. The affected firmware versions include multiple models, amplifying the attack surface. Mitigation requires patching the PHP environment or the script itself to sanitize input and prevent null byte injection.
Platform: Mozart FM Transmitter
Version: Multiple versions
Vulnerability: Arbitrary File Read
Severity: Critical
date: 2025-11-25
Prediction: Patch expected 2026-Q1
What Undercode Say:
Analytics:
curl -s “http://target/var/tdf/download_setting.php?filename=../../../../etc/passwd%00”
$filename = $_GET[‘filename’] . ‘.tgz’;
// Vulnerable code: null byte injection in fopen($filename)
?>
How Exploit:
Craft URL with traversal and null byte.
Send unauthenticated GET request.
Retrieve sensitive file contents.
Protection from this CVE
Update PHP version.
Sanitize input parameters.
Implement authentication checks.
Impact:
Information disclosure.
Potential system compromise.
Unauthorized data access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
