taogogo / taocms

taoCMS is an incredible tiny CMS( Content Management System) , writen in PHP and support MySQL/Sqlite as the database(MIT License)

MIT License

60 stars 21 forks source link

arbitrary file read vulnerability #15

Open destinypwd opened 2 years ago

destinypwd commented 2 years ago

analysis

The location of the vulnerability is line 55 in \taocms\include\Model\File.php and we can see that the path parameter is passed directly to file_get_contents function without filtering

20220110154029

20220110154107

poc

After login as admin,Enter the file management interface and edit function

Get packets using brup Any file can be read after changing the path parameter

20220110153415

xiaoabai commented 1 year ago

根据你的poc，这个漏洞代码应该为File.php第82-86行