jizhiCMS File Download Vulnerability in Admin Plugins Update Endpoint

A file download vulnerability has been identified in jizhiCMS version 1.6.7. This vulnerability exists in the admin plugins update endpoint, allowing authenticated administrators to download arbitrary files. Exploitation involves sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the admin.php/Plugins/update.html endpoint. Include the action parameter set to 'start-download', along with a malicious filepath and download_url. This will initiate the download of the specified file from the provided URL.