The design defect of the notedog allows you to delete any images on the website.

Improper path processing allows registered users to delete arbitrary images on the website

Detailed description:

Register a user and Click Upload Avatar After logging on. For example, the address is:
Http://www.bkjia.com/jishigou30s/index. php? Mod = settings & code = face
The file & temp_face =././images/noavatar.gif watermark is deleted.
Proof of vulnerability:

You can simply find a record dog station to prove it. (Write permission is required for images)
Solution:

Forcibly judge and filter all input paths at the front end

This vulnerability is caused by a poor judgment on the deletion of temporary files when the website uploads the profile picture. Thanks for your feedback, we have provided patches and updated the relevant downloads.
See: http://cenwor.com/thread-12847-1-1.html


Author Moyo