search

xwlrbh / Catfish

Catfish CMS
Other
8 stars 1 forks source link

CatfishCMS-v4.8.54 getshell and Arbitrary command execution #4

Open yundiao opened 5 years ago

yundiao commented 5 years ago

Testing environment: windows + php5.4.45 +apache (phpStudy Integrated environment) CMS version: v4.8.54

  1. Intercept a request of the home page. Change method to POST. image

  2. Construct request image

  3. Exec a windows command to getshell image

  4. Test phpinfo() image

  5. We can create a new file to exec any command image

  6. We can exec any system command now image

xwlrbh commented 5 years ago

thanks