search

bg5sbk / MiniCMS

至简的个人网站内容管理系统
http://1234n.com/?projects/minicms/
227 stars 61 forks source link

Information Disclosure Vulnerability(Need Authentication) in post-edit.php #28

Closed HLHai closed 3 years ago

HLHai commented 5 years ago

I found one information leakage vulnerabilities in MiniCMS, you need to login the backstage first.If your PHP version is 5.4, you will be successful.

It reveals the real path of the MiniCMS files

Repetition steps

1、Login in to the backstage http://127.0.0.1/MiniCMS1/mc-admin/ 2、Post an article

image

This vulnerability reveals the full path of MiniCMS

tangxiaofeng7 commented 5 years ago

这个也能刷CVE吗？？？

HLHai commented 5 years ago

我也想知道

tangxiaofeng7 commented 5 years ago

牛P牛P

HLHai commented 5 years ago

人家有90%的几率不会给的

tangxiaofeng7 commented 5 years ago

99% 这种报错的话 不算的

HLHai commented 5 years ago

因为有大佬提交过，还通过了，我才想试一下，去cve搜一下minicms可以看到很多这种报错出路劲的cve

tangxiaofeng7 commented 5 years ago

CVE-2018-10423 还真是 你这个重复了

HLHai commented 5 years ago

哥们你没有复现过cve吧，你去仔细研究一下，只要是字段不一样，就算是不同的，不是只要暴露了路劲就是相同的漏洞 https://bbs.ichunqiu.com/thread-48788-1-1.html

HLHai commented 5 years ago

我也是把这个cms 所有的cve都复现了一遍才知道的

tangxiaofeng7 commented 5 years ago

哈哈哈 是啊 我也在学

HLHai commented 5 years ago

来找我们的小伙伴玩呀，群地址在最下面784278256 斜眼笑

tangxiaofeng7 commented 5 years ago

ok