KindEditor editor upload and modify shell Vulnerability

Author: relywind
 
Affected Versions:
KindEditor 3.5.2 ~ 4.1
 
Vulnerability exploitation:
Open the editor and rename it 1.jpg to upload an image,
Open file management, go to the "down" directory, and jump to the last page. The last image is a sentence we uploaded.
Click rename
 
 
 
Open Google's review elements
 
 
 
Find form www.2cto.com
 
 
 
Change "jpg" to "asp"
 
 
 
Change name to 1 and save
 
 

 
A single statement is generated, and the connection address is
 
Http://www.2cto.com/upfiles/down/1.asp