Open
Description
Any file upload exists at the background plug-in

Locate file: /app/LKT/webapp/modules/plug_ins/actions/addAction.class.php

Firstly, the upload format is not filtered. Secondly, uploading the compressed package will decompress the index file in the compressed package and automatically include the file
As a result, files with any suffix can be uploaded or compressed packages can be uploaded. The compressed packages contain webshell files

Upload succeeded!
Metadata
Assignees
Labels
No labels

