yeqifu carRental Path Traversal Vulnerability in AppFileUtils.java

A path traversal vulnerability has been identified in yeqifu carRental versions prior to 3fabb7eae93d209426638863980301d6f99866b3. The issue arises in the 'removeFileByPath' function within 'src/main/java/com/yeqifu/sys/utils/AppFileUtils.java', where the 'carimg' parameter can be manipulated to traverse directories. This vulnerability can be exploited remotely, allowing unauthorized deletion of files on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the 'car/updateCar.action' interface with the 'carimg' parameter set to a path traversal payload, such as '../test/123456.txt'. This will bypass normal file handling and delete the specified file. After the initial upload, the 'carimg' parameter can be used again to delete files by updating the vehicle information, effectively removing the files from the server.