CVE-2022-1034: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2022-03-22T08:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Controller/AdminUpdateController.class.php, web_src/src/components/admin/about/Index.vue
Commit date: 2022-03-20 16:07:48 +0800
Commit message: Security update / 安全性更新

Diff: diff --git a/server/Application/Api/Controller/AdminUpdateController.class.php b/server/Application/Api/Controller/AdminUpdateController.class.php
index 63923b628..66de76bad 100644
--- a/server/Application/Api/Controller/AdminUpdateController.class.php
+++ b/server/Application/Api/Controller/AdminUpdateController.class.php
@@ -26,12 +26,25 @@ class AdminUpdateController extends BaseController {
     public function download(){
         $this->checkLogin();
         $this->checkAdmin();
         set_time_limit(1000);
         ini_set('memory_limit','500M');
-        $new_version = I("new_version") ;
-        $file_url = I("file_url") ;
+        //获取当前版本
+        $text = file_get_contents("../composer.json");
+        $composer = json_decode($text, true);
+        $version = $composer['version'] ;
+        $url = "https://www.showdoc.cc/server/api/open/checkUpdate";
+        $res = http_post($url , array("version"=>$version));
+        $res_array = json_decode($res,true);
+        $new_version =$res_array['data']['new_version'] ;
+        $file_url =$res_array['data']['file_url'] ;
+
+        if(!$file_url){
+            $this->sendError(10101,'检测更新时异常');
+            return ;
+        }
+
         $version_num = str_replace("v","",$new_version) ;
 
         $showdoc_path = "../" ;
 
         // 进行文件读写权限检查
diff --git a/web_src/src/components/admin/about/Index.vue b/web_src/src/components/admin/about/Index.vue
index 105c7c4ab..2e49bcea8 100644
--- a/web_src/src/components/admin/about/Index.vue
+++ b/web_src/src/components/admin/about/Index.vue
@@ -63,12 +63,11 @@ export default {
   data() {
     return {
       isUpdate: false,
       cur_version: '',
       new_version: '',
-      url: '',
-      file_url: ''
+      url: ''
     }
   },
   methods: {
     getCurVersion() {
       this.request('/api/common/version', {}).then(data => {
@@ -79,25 +78,21 @@ export default {
     },
     checkUpadte() {
       this.request('/api/adminUpdate/checkUpdate', {}).then(data => {
         if (data && data.data && data.data.url) {
           this.url = data.data.url
-          this.file_url = data.data.file_url
           this.new_version = data.data.new_version
           this.cur_version = data.data.version
           this.isUpdate = true
         }
       })
     },
     clickToUpdate() {
       let loading = this.$loading({
         text: '正在下载更新包...'
       })
-      this.request('/api/adminUpdate/download', {
-        new_version: this.new_version,
-        file_url: this.file_url
-      }).then(
+      this.request('/api/adminUpdate/download', {}).then(
         data => {
           loading.close()
           loading = this.$loading({
             text: '正在更新文件...'
           })

Vulnerable code:         $new_version = I("new_version") ;
        $file_url = I("file_url") ;
      url: '',
      file_url: ''
          this.file_url = data.data.file_url
      this.request('/api/adminUpdate/download', {
        new_version: this.new_version,
        file_url: this.file_url
      }).then(
Fixed code:         //获取当前版本
        $text = file_get_contents("../composer.json");
        $composer = json_decode($text, true);
        $version = $composer['version'] ;
        $url = "https://www.showdoc.cc/server/api/open/checkUpdate";
        $res = http_post($url , array("version"=>$version));
        $res_array = json_decode($res,true);
        $new_version =$res_array['data']['new_version'] ;
        $file_url =$res_array['data']['file_url'] ;

        if(!$file_url){
            $this->sendError(10101,'检测更新时异常');
            return ;
        }

      url: ''
      this.request('/api/adminUpdate/download', {}).then(