There is a "Unsafe Unzip" vulnerability that can get webshell

[fupinglee]

ver: V4.0.20180210
using a specially crafted zip archive, that holds path traversal filenames.when you used unzip method you will get a shell

a zip looks like this:

the path you will get from there:

(so,your website true path is 'C:\tomcat\apache-tomcat-7.0.81\apache-tomcat-7.0.81\webapps\publiccms')

upload and unzip

'cmd.jsp' will write into your server

Execute the command

shell.zip

[unh3x]

So it's a shell upload in background, requires administrator authorization?

[fupinglee]

@unh3x
need open upload and unzip

[sanluan]

After fixing the bug，a zip file like this:

Upload and decompress or decompress here

The files will be put here when they are decompress

The files will be put here when they are decompress here