Arbitrary File Upload in a substation of Lenovo can control the server and repair

Attackers can upload arbitrary files to execute script files.
1. url: http://lefen.lenovo.com/index.php/kebi/ 2. Upload the image, only the image type is verified, the image format is not verified. (Upload a jpg file with a single sentence inserted, capture the packet with burp, and modify the suffix of the uploaded file to php .) When you upload and capture a packet, modify the php file. 1. Permission, version 2. Database 3. User Information Leakage 4. The site also has directory browsing
Solution:

1. Upload filtering 2. script execution is not allowed in the upload directory, or uploaded to a remote server 3. Weak Database Password 123456 lenovo Modification