PerfreeBlog Arbitrary File Deletion Vulnerability in Theme Management Function

An arbitrary file deletion vulnerability has been identified in PerfreeBlog version 4.0.11. The issue arises in the 'unInstallTheme' function, where the 'themePath' is processed without adequate validation. This flaw allows for directory traversal attacks, enabling the deletion of any file on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server.

Reproduction

To reproduce this vulnerability, log into the PerfreeBlog admin panel and navigate to the Theme Management section. Click to uninstall a theme and capture the request. Create a text file in the root directory, then modify the 'themePath' parameter in the request to include directory traversal sequences, pointing to the text file. Send the modified request to the server, which will process it and delete the specified file.