MCCMS Arbitrary File Deletion Vulnerability in Backups.php Component

An arbitrary file deletion vulnerability has been identified in MCCMS version 2.7.0, specifically within the Backups.php component. This vulnerability allows attackers to delete any file on the server, potentially leading to the execution of arbitrary commands.

Impact

Exploitation of this vulnerability can disrupt the normal operation of the application or the underlying operating system.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the backup management feature. Create a backup file, which will be listed in the interface. After the backup is created, use the provided option to delete the backup file. This action will trigger the vulnerability, as the deletion request can be manipulated to remove arbitrary files from the server.