MRCMS Arbitrary File Write Vulnerability

An arbitrary file write vulnerability has been identified in MRCMS version 3.1.2. The issue arises in the component '/file/save.do', where the application fails to properly validate file paths before writing files. The vulnerability allows for directory traversal and the upload of files with certain extensions, such as '.jspf', which can be exploited to execute malicious code.

Impact

Exploitation of this vulnerability allows for arbitrary file writing, which could be used to upload malicious files that are later executed by the server.

Reproduction

The vulnerability can be reproduced by sending a request to the '/file/save.do' endpoint with a file name that includes a directory traversal sequence and a bypassing extension, such as '.jspf'. The server will write the file without proper path validation, allowing for the execution of uploaded web shells.