remote code execution need fix

Exploitation Process:

Click "Add Theme" here.
![输入图片说明](https://foruda.gitee.com/images/1736926122091752751/8b5c8666_8744695.png "屏幕截图")
In the pop-up window, select the "Click to Select Theme Package" button.
![输入图片说明](https://foruda.gitee.com/images/1736926160965891469/2cf91060_8744695.png "屏幕截图")
Uploading a specially crafted YAML file will achieve remote code execution.
Analysis:
Transmission Path:
![输入图片说明](https://foruda.gitee.com/images/1736926217175826624/1a796fd2_8744695.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1736926236098596651/498c9733_8744695.png "屏幕截图")
sink：
![输入图片说明](https://foruda.gitee.com/images/1736926263316214056/2b4989e0_8744695.png "屏幕截图")

Issue: From the code's content, the system does not impose content restrictions on the zip file uploaded by the user. By crafting a special theme.yaml file and compressing it for upload, remote code execution can be achieved.
poc:
1.creat a yaml name as theme.yaml
2.writ this in yaml, then zip the yaml as theme.zip
![输入图片说明](https://foruda.gitee.com/images/1736991243381706142/12c3f78b_8744695.png "屏幕截图")
3.about jar you could get it from https://github.com/artsploit/yaml-payload.git

泰山AI/泰山内容管理系统 tarzan-cms

内容风险标识

评论 (1)

泰山AI/泰山内容管理系统 tarzan-cms .gitee-modal { width: 500px !important; }

内容风险标识