Skip to content

Any file upload exists at the background plug-in #11

Open
@reclu3a

Description

Any file upload exists at the background plug-in
image

Locate file: /app/LKT/webapp/modules/plug_ins/actions/addAction.class.php
image

Firstly, the upload format is not filtered. Secondly, uploading the compressed package will decompress the index file in the compressed package and automatically include the file

As a result, files with any suffix can be uploaded or compressed packages can be uploaded. The compressed packages contain webshell files
image

Upload succeeded!

image

The file is in the /APP/LKT/zip/
Let's visit
image

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions