Authenticated file deletion via unchecked neirong path

Path traversal in Shopwind 3.4.2 and earlier allows remote authenticated users to delete arbitrary server files via the neirong parameter. DbController.php accepts neirong as a deletion path without constraining traversal outside the intended directory. Administrative access is required, and deletion is limited to files writable by the web-service account, including files whose loss can interrupt the site.