ZenTaoPMS Directory Traversal Vulnerability Allowing Remote Code Execution

A directory traversal vulnerability has been identified in ZenTaoPMS versions 18.11 through 21.6.beta. The issue resides in the file '/module/ai/control.php', where attackers can execute arbitrary code by uploading a crafted file.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where ZenTaoPMS is installed.

Reproduction

To reproduce this vulnerability, upload a malicious file designed to exploit the directory traversal flaw in 'module/ai/control.php'. The crafted file upload should be able to execute arbitrary code on the server.