An unauthenticated arbitrary file download vulnerability in Easyndexer 1.0 allows remote attackers to access sensitive system files, posing a high risk to information confidentiality.

The application fails to properly sanitize user input in the file parameter of the showtif.php script, which allows an unauthenticated attacker to perform path traversal and download arbitrary files from the host system.

Successful exploitation allows unauthorized parties to read sensitive configuration and initialization files from the server. This exposure can lead to the compromise of database credentials, application secrets, or other proprietary information, directly impacting the confidentiality of the affected environment. Given the CVSS score of 7.5, this vulnerability represents a high-severity risk that requires immediate attention.

Immediate Action: As no official vendor patch is available, users should restrict access to the affected directory or disable the vulnerable showtif.php script entirely to prevent exploitation.

Proactive Monitoring: Review web server access logs for anomalous POST requests to showtif.php containing file paths or directory traversal patterns, such as sequences of dots and slashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block path traversal attempts targeting the showtif.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit Database (EDB-ID 45835).

This vulnerability presents a significant risk due to the ease with which sensitive files can be exfiltrated by unauthenticated actors. Because there is no vendor-provided patch, organizations using Easyndexer 1.0 must prioritize isolating the application from the network or disabling the vulnerable functionality immediately to prevent unauthorized data access.