File upload causes getshell in Windows System

## Test environment

OS：windows
ERMEB version：3.1.0+
download time: 2020/1/18

## Code analysis

search some keyword like "上传文件非法",and the file path ```/crmeb/crmeb/services/UploadService.php```  in line 410.

![test-1](https://images.gitee.com/uploads/images/2020/0120/141204_2ef0f633_1763950.png "屏幕截图.png")

In the ```file()``` funcion,it will call ```getOriginalExtension()``` in line 409.The ```getOriginalExtension()``` is in line 130 with the file ```/crmeb/vendor/topthink/framework/src/think/file/UploadedFile.php```.

![test-2](https://images.gitee.com/uploads/images/2020/0120/141426_c5319be1_1763950.png "屏幕截图.png")

From the code point of view, it is only compared by obtaining the suffix name, and no filtering is performed.

## Vulnerability Test

### Step-1

first,you need to add a configuration item about file upload like this.

![test-3](https://images.gitee.com/uploads/images/2020/0120/141707_6dbd9836_1763950.png "屏幕截图.png")

The contents of the configuration items are as follows.

![test-4](https://images.gitee.com/uploads/images/2020/0120/141822_8851fa06_1763950.png "屏幕截图.png")

### Step-2

Open the file upload configuration item in settings,and it like this.

![test-5](https://images.gitee.com/uploads/images/2020/0120/142002_a898d589_1763950.png "屏幕截图.png")

In this operation, you can see that there is an option named ```fileuPload```,it was create in the ```Step-1```.Then you can click it and upload file in this.

Then I upload one file is name ```shell.jpg```,and the content is like this.

### Payload Content

```
<?php

phpinfo();

?>

```

and modify the file extension to ```.php::$DATA``` when uploading was like this.Because the character ```::$DATA``` is automatically ignored in the windows system, it can be bypassed by this character.

![test-6](https://images.gitee.com/uploads/images/2020/0120/142559_8638218f_1763950.png "屏幕截图.png")

it will response a uri address like this.

![test-7](https://images.gitee.com/uploads/images/2020/0120/142647_1e45159b_1763950.png "屏幕截图.png")

#### Shell URL

```
http://127.0.0.1/uploads/config/file/20200119/f97d96036a769ae2d3154b591304f1df.php
```

### Step-3

access this url and you will getshell for this web server.

![test-7](https://images.gitee.com/uploads/images/2020/0120/142838_5bad3844_1763950.png "屏幕截图.png")

## Solution

filter ```::$DATA```.

GVP 众邦科技/CRMEB开源商城系统

内容风险标识

评论 (2)

GVP众邦科技/CRMEB开源商城系统

内容风险标识