Hi, dev team! The code in this file is vulnerable: Arbitrary file write And execute the command through this file
Vulnerability discovery
Vulnerable code found on lines 20 to 23 in the /wcms/wex/html.php file
if (isset($_GET['finish'])) {
$path = $_GET['finish'];
file_put_contents($path, $_POST['textAreaCode']);
Since the finish variable of the GET request and the textAreaCode variable of the POST request are controllable, an attacker can use the file_put_contents function to write malicious code into a custom file
construct poc
Use controllable variables to write malicious code into the shell.php file in the current directory
The payload is as follows:
Hi, dev team! The code in this file is vulnerable: Arbitrary file write And execute the command through this file
Vulnerability discovery
Vulnerable code found on lines 20 to 23 in the /wcms/wex/html.php file
Since the finish variable of the GET request and the textAreaCode variable of the POST request are controllable, an attacker can use the file_put_contents function to write malicious code into a custom file
construct poc
Use controllable variables to write malicious code into the shell.php file in the current directory The payload is as follows:
get shell
Access the written malicious file, find that the malicious code is successfully executed, and echo it out![image](https://user-images.githubusercontent.com/110379183/232104725-4b1163cf-21f1-4459-8537-7cb40af49bd2.png)