Shanghai Lingdang Information Technology Lingdang CRM Path Traversal Vulnerability

A path traversal vulnerability has been identified in Shanghai Lingdang Information Technology's Lingdang CRM, affecting versions through 8.6.0.0. The issue arises in the file '/crm/weixinmp/index.php' when specific query parameters are manipulated. This vulnerability allows for remote exploitation by traversing directories and potentially accessing unauthorized files on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could lead to exposure of sensitive information or application files.

Reproduction

To reproduce this vulnerability, send a request to '/crm/weixinmp/index.php' with the 'userid', 'module', 'usid', 'action', 'minipro_const_type', 'related_module', and 'pathfile' parameters. Manipulate the 'pathfile' argument to traverse directories and access restricted files.