IdeaCMS Unrestricted File Upload Vulnerability in SaveUpload Function

A critical unrestricted file upload vulnerability has been identified in IdeaCMS versions through 1.6. The issue arises in the saveUpload function, where improper input validation allows for the upload of files with dangerous extensions. This vulnerability can be exploited remotely, potentially leading to the execution of uploaded web shells with server permissions.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which can be used to upload malicious files such as web shells that execute on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the '/admin/config/saveUpload.html' endpoint with the 'uptype' parameter set to include a file extension that is normally blocked, such as 'php'. The 'uplocation' parameter can be set to '1' for local uploads. After the upload is processed, the uploaded file can be accessed through the application's upload directory.