EasyTalk Weibo X2.0.2 foreground Arbitrary File Deletion vulnerability and repair

EasyTalk has a problem with the code used to process the user's uploaded avatar. If it is determined that the user's uploaded avatar is invalid, the user will delete the uploaded invalid Avatar File Based on the path of $ _ POST ['imgpath. The vulnerability lies in EasyTalk's improper handling of $ _ POST ['imgpath']. If you do not determine the parameters submitted by the user, the files pointed to by imgpath will be deleted directly.
In the function doface2 of SettingAction. class. php 101:

Public function doface2 (){
$ Ysw = $ _ POST ['ysw '];
'If ($ ysw> 460 ){
$ Zoom = intval ($ ysw)/460;
} Else {
$ Zoom = 1;
}
$ X = $ _ POST ['X'] * $ zoom;
$ Y = $ _ POST ['y'] * $ zoom;
$ W = $ _ POST ['W'] * $ zoom;
$ H = $ _ POST ['H'] * $ zoom;
$ Imgpath = ET_ROOT. $ _ POST ['imgpath']; // link with ET_ROOT to imgpath
$ Ext = strtolower (getExtensionName ($ imgpath); // extract the suffix

Import ("@. ORG. IoHandler ");
$ IoHandler = new IoHandler ();
If ($ ext! = 'Jpg '& $ ext! = 'Jpeg '& $ ext! = 'Gif' & $ ext! = 'Png '){
// If the suffix is invalid, delete the uploaded file.
$ IoHandler-> DeleteFile ($ imgpath );
Cookie: set ('setok', 'face2 ');
Header ('location: '. SITE_URL.'/Setting/face ');
Exit;
}
........
}

Delete index. php

 


 

 

Solution:

Judge user input and filter
Author's head