Unauthorized operation due to multiple design defects in We7CMS

Brief description: multiple design defects in We7CMS cause multiple unauthorized operations and serious security problems.
Details: After installation, the installation directory is not deleted, and some files can be called directly. For example:
Http://www.westengine.com/install/InstallWebService.asmx
Check that all successful cases exist.
Http://www.bbac.com.cn/install/InstallWebService.asmx
Http://www.shanxihighway.com/install/InstallWebService.asmx
......
 
Direct call
 
 
 
 
You can perform more serious operations .... For example, after re-installation, go to the background to get shell, add users, and recreate the database.

Solution:

You know!
 
 
Author kobin97 @ wooyun