A Directory Traversal vulnerability

[Zh3-H4ck]

test version:2.4.7

0x00 description

Frontaccounting is using the function clean_file_name() to eliminate '../' in the file name submitted by the user to avoid directory traversal vulnerability.

However, some variables do not use the function clean_file_name() in admin/inst_lang.php, which can cause attackers submit the language package containing the language code of '../'. Affter adding successfully, by deleting it, the attacker can emptied specified folder like the examples.

admin/inst_lang.php:156

admin/inst_lang.php:240

0x01 Example:empty admin folder

0. Before clearing the admin folder
   

1. The administrator logs in and creates a new language pack
   
   

2. Set the language code to ../admin and save it
   

3. Delete the language pack you just created
   

4. After deleting successfully, the admin folder will be emptied
   

[FrontAccountingERP]

Yes, indeed. Fix is added to the repo.

[cambell-prince]

Yes, indeed. Fix is added to the repo.

Should this issue be closed?

[Zh3-H4ck]

ok