Security vulnerability in File Manager Download function

[MaxXor]

There exists a security vulnerability in the File Manager Download function which can be only exploited when the File Manager Window in the Server is opened (needs to be the Window on the malicious Client). If the File Manager Window is closed then it's not exploitable.

By modifying the Filename to a path like ..\..\file in DoDownloadFileResponse Client packet the Server will accept the file download and place the file outside of the download directory.

Affected versions: v1.0.0.0 - 1.3.0.0

[ViCrack]

对于这个目录回溯的漏洞，在HandleGetKeyloggerLogsResponse方法中也可能有类似的情况出现，
比如获取日志文件的名称04-17-2018中包含..\..\。

For loopholes in this directory, a similar situation may occur in the HandleGetKeyloggerLogsResponse method.For example, get the name of the log file 04-17-2018 contains ..\..\

[MaxXor]

@ViCrack Thanks for reporting this, I'll check it.

edit: Fixed, thank you! 👍