CmsEasy Directory Traversal Vulnerability Allowing Arbitrary File Deletion

A critical directory traversal vulnerability has been identified in CmsEasy version 7.7.7.9. The issue arises in the 'backAll_action' function within 'lib/admin/database_admin.php'. This vulnerability allows remote attackers to manipulate the 'select[]' parameter, leading to path traversal and arbitrary file deletion. The exploit has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server.

Reproduction

To reproduce this vulnerability, log into the admin panel and send a POST request to '/index.php?case=database&act=backAll&admin_dir=admin&site=default'. Include the 'submit' parameter set to '1' and the 'select[]' parameter with a crafted value that traverses directories, such as '.....///.....///test.txt'. This will delete the specified file from the server.