mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
35 lines
587 B
Markdown
35 lines
587 B
Markdown
|
# 极致CMS 后台文件编辑插件 任意文件上传
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
极致CMS后台中含有文件编辑插件，通过逻辑漏洞可任意修改文件
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
极致CMS
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
icon_hash="1657387632"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登陆后台查看插件处，有一个后台编辑的插件
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
安装之后设置密码并使用
|
|||
|
|
|
|||
|
|
- 如果已经设有密码，重新安装插件即可解决密码未知问题
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
修改为php代码
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
成功执行php代码的命令
|