Several arbitrary file deletions in feifeicms 4. 0

1. Location Lib/Lib/Action/Admin/DataAction.class.php, two places

Unprocessed GET and POST parameters are spliced directly to the path, causing the file to be deleted. However, the actual local test found that the _ bak folder does not exist by default and needs backup function before it can be generated.

Global search for the _ bak field to find a place for the creation of the _ bak folder, the write_file function on line 51 of Lib/Lib/Action/Admin/DataAction.class.php.

When you enter the write_file function, you can see that the encapsulated mkdir method mkdirss is called internally

Now to construct the payload, you need to make a backup to create the _ bak folder. Here you need to satisfy strlen ($sql) > = $filesize*1000.

Backup succeeded

The following construction file deletes payload, accesses http://localhost:8888/4.0.181010/index.php?s=/admin-data-del&id=../../../../../../../../../Users/xx/Desktop/123.txt, and deletes 123.txt file

The other principle is the same, and it is no longer tested here.

2. Location Lib/Lib/Action/Admin/TplAction.class.php,88

You can see that the id parameter is not filtered and can be deleted arbitrarily. Create a 123.txt on the desktop during the test, and construct the payload as http://localhost:8888/4.0.181010/index.php?s=/admin-tpl-del&id=/Users/xx/Desktop/123.txt

You can see that the file has been deleted.