Listen to this Post
The vulnerability exists within the `file::delete` function of /file/module/file/control.php. This function handles requests to delete files stored within the ZenTao application by accepting a `fileID` parameter. The flaw is an improper access control check on this parameter. When a request is made to delete a file, the function does not adequately verify if the authenticated user has the necessary permissions or ownership rights to delete the specific file referenced by the manipulated fileID. An attacker, authenticated with a low-privilege account, can remotely send a crafted HTTP request containing the `fileID` of a file belonging to another user or a system file. Because the authorization check is missing or insufficient, the application executes the deletion operation based solely on the provided identifier, leading to unauthorized file deletion. This constitutes a privilege management failure, allowing a user to perform actions outside their intended authority.
Platform: ZenTao
Version: <=21.7.6-8564
Vulnerability: Improper Access Control
Severity: Medium
date: 2025-11-30
Prediction: Patch 2025-12-07
What Undercode Say:
Analytics
grep -r "file::delete" /path/to/zentaopms/module/file/ curl -X POST 'http://target/api.php?m=file&f=delete' -d 'fileID=1234' cat module/file/control.php | grep -A 10 -B 5 "function delete"
How Exploit:
1. Attacker logs in with a low-privilege account.
- Attacker identifies a target file ID via enumeration or other information leakage.
- Attacker sends a POST request to the vulnerable endpoint (
/api.php?m=file&f=delete) with the victim’sfileID. - Server processes the request without proper authorization, deleting the file.
Protection from this CVE:
1. Upgrade to ZenTao version 21.7.7.
2. Implement proper authorization checks verifying user/file ownership.
3. Apply the principle of least privilege.
Impact:
Unauthorized file deletion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
