ThinkPHP log information leak vulnerability exists in tpcms v3.2

Hello, after testing, I found that tpcms v3.2 has a vulnerability -- ThinkPHP log information leak.  
Since the CMS code does not restrict the visitor's access to ThinkPHP's log directory, anyone can read ThinkPHP's Log through the URL. Such logs contain the administrator's user name, password, operation behavior, system information, etc. Sensitive information brings greater security risks to the system.

URL:
http://domain(or IP)/Data/Runtime/Logs/Admin/21_07_01.log
http://domain(or IP)/Data/Runtime/Logs/Home/21_07_01.log
http://domain(or IP)/Data/Runtime/Logs/Member/21_07_01.log

reference：
![Image description](https://images.gitee.com/uploads/images/2021/0701/134847_0a257b7c_9371028.png "admin_log.png")

![Image description](https://images.gitee.com/uploads/images/2021/0701/140031_dfcc7883_9371028.png "admin_log3.png")

![Image description](https://images.gitee.com/uploads/images/2021/0701/140041_ccc3f662_9371028.png "admin_log1.png")

![Image description](https://images.gitee.com/uploads/images/2021/0701/134900_78c158ca_9371028.png "home_log.png")

![Image description](https://images.gitee.com/uploads/images/2021/0701/134908_45949284_9371028.png "member_log.png")

快乐源泉/tpcms

Content Risk Flag

Comments (0)

快乐源泉/tpcms .gitee-modal { width: 500px !important; }

Content Risk Flag