[ Security Issue ] Rename Function Restrict Bypass

[Jindom]

Hi Team,

Please note that there is a possible way to bypass the restriction and manage to upload a malicious php file to the system. The vulnerable code located in /admin/media/rename2.php

There aren't any filtering and protection against user's input "name" and "extension". A user may upload a file called phpinfo.txt and rename it to phpinfo.php by entering the "name" to "phpinfo.ph" "extension" to "p". The following screenshot shows that the malicious user successfully upload phpinfo.php file to the webapp directory.

[instantflorian]

Woops, thanks for the advice. Fixed with 462864b6fe5ca16aea882fe515cd1124381c1699