A file download vulnerability in jizhiCMS 1.6.7 allows authenticated administrators to perform unauthorized file operations, posing a significant risk to system integrity.

The application contains a file download vulnerability within the admin plugins update endpoint. This flaw requires an attacker to possess administrative privileges to send crafted POST requests with malicious filepath and download_url parameters to trigger the unauthorized action.

Successful exploitation allows an authenticated administrator to download arbitrary files from the server, which can lead to sensitive information disclosure or the staging of further malicious payloads. With a CVSS score of 8.8, this vulnerability represents a high risk, as it facilitates the potential compromise of the underlying server environment and application configuration files.

Immediate Action: As no specific patch version is documented, administrators should restrict access to the administrative dashboard to trusted personnel only and monitor for any suspicious activity related to the /admin.php/Plugins/update.html endpoint.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugins update endpoint, particularly those involving unusual file paths or external URLs.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests to the plugins update endpoint that contain suspicious file path parameters or unauthorized external download sources.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 48361.

Given the high severity of this vulnerability, organizations currently utilizing jizhiCMS 1.6.7 must take immediate steps to secure the administrative interface. Because a public proof-of-concept exists, the potential for exploitation by malicious actors is elevated. It is strongly recommended to audit administrative accounts and apply strict network-level access controls to the management panel until a vendor-supplied security update is applied.