search

eddy8 / LightCMS

LightCMS 是一个基于 Laravel 开发的轻量级 CMS 系统，也可以作为一个通用的后台管理框架使用。A lightweight cms/admin framework powered by Laravel.
Apache License 2.0
351 stars 86 forks source link

Arbitrary file read & RCE vulnerability in "catchImage" #19

Closed gml-sec closed 3 years ago

gml-sec commented 3 years ago

Description

There is no filtering when downloading external images, which can casue arbitrary file reading and remote code execution.

Impact Version

lightcms latest version (v1.3.5)

Steps to Reproduce

Arbitrary File Reading

image image

Remote Code Execution

Place the php file which wants to be executed on your own server, and download it: image

image

eddy8 commented 3 years ago

thanks