EyouCMS Unrestricted File Upload Vulnerability in Member Avatar Component

A vulnerability allowing unrestricted file upload has been identified in EyouCMS versions through 1.7.1 and 5.0. The issue arises in the Member Avatar Handler, specifically within the check_userinfo function of Diyajax.php. The vulnerability can be exploited remotely by manipulating the viewfile parameter, leading to unauthorized file uploads that could be processed within the application's environment.

Impact

Exploitation of this vulnerability allows for unauthorized file uploads, which could be used to execute malicious code on the server.

Reproduction

To reproduce this vulnerability, first upload an image through the avatar feature as a regular user. Then, send a POST request to the check_userinfo API with the viewfile parameter set to a crafted file path that includes a payload. The server will execute the payload, demonstrating the vulnerability.