PECSM-TEAM 2.2.2 has a file upload vulnerability in /Public/?g=Team&m=Setting&a=upgrade

lazyphp / PESCMS-TEAM

The open source task management system

GNU General Public License v2.0

84 stars 36 forks source link

Closed snappyJack closed 5 years ago

snappyJack commented 6 years ago

This page let user upgrade the PESCMS system manually. default

Follow the mtUpgrade funtction,the upload file extension must be “zip” default

and follow the unzip function default

Follow the simulateInstall function and install function,we can see the file decompression in root directory default default

so,we can create a evil.php default

and compression it as evil.zip,and upload the evil.zip, default

at last ,the system decompress evil.zip and evil.php in root directory. default

lazyphp commented 6 years ago

英语水平有限，这里用中文吧：因为考虑到程序都是内网为主，所以手动更新的程序并没有与官方进行哈希验证。所以确实会存在一个提权的风险。目前这些各项功能还在调优中，不久将来的版本更新功能将需要与官方的更新包进行哈希验证，匹配正确才会执行更新。

lazyphp commented 5 years ago