Vulnerability
The fetch and display functions in the HomeBaseController class(parent class of IndexController) and AdminbaseController class are assigned as public so that they can be accessed easily from outside. A remote attacker can use this vulnerability to construct a malicious URL and write files of arbitrary content to the server without any permission to achieve the purpose of remote code execution.
Affected versions
ThinkCMF X1.6.0,ThinkCMF X2.1.0,ThinkCMF X2.2.0,ThinkCMF X2.2.1,ThinkCMF X2.2.2ThinkCMF X2.2.3
Mitigation / Precaution
- We recommend you to change the modifiers of the display and fetch functions in the HomebaseController.class.php and AdminbaseController.class.php classes to protected.
Written by
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 10 days
