ThinkSNS某处任意上传文件漏洞，获取官方站点控制权

### 简要描述： ThinkSNS某处任意上传文件漏洞，可导致网站沦陷、用户数据泄露，你说是不是高危？ ### 详细说明： ThinkSNS群组上传文档处存在任意上传文件漏洞，可导致四个网站沦陷、用户数据泄露，你说是不是高危？ 1.我们打开一个群组上传文档 [<img src="https://images.seebug.org/upload/201301/09094108235ab7e65c7b3ea90e0f21b0a69c6ea9.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094108235ab7e65c7b3ea90e0f21b0a69c6ea9.jpg) 2.开始抓包，上传一个图片网马比如yy.jpg，然后在包里面改为yy.php [<img src="https://images.seebug.org/upload/201301/0909420839d3cad2fd3d4a3a5f20bf954a1988c1.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/0909420839d3cad2fd3d4a3a5f20bf954a1988c1.jpg) 3.于是上传成功 [<img src="https://images.seebug.org/upload/201301/090943052ebcb025d7bb0ec3ccd77b9cfdc7a126.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/090943052ebcb025d7bb0ec3ccd77b9cfdc7a126.jpg) 看看文件，额~~~~ [<img src="https://images.seebug.org/upload/201301/0909443601c4a657a15dd5abb316ebdaae759667.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/0909443601c4a657a15dd5abb316ebdaae759667.jpg) 4.连一连 [<img src="https://images.seebug.org/upload/201301/09094625f6544911a3f27b984ff7720fd399e1de.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094625f6544911a3f27b984ff7720fd399e1de.jpg) 5.跨一跨 [<img src="https://images.seebug.org/upload/201301/09094650d22ae91e7a5e11c9e0b5e9e39f82419a.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094650d22ae91e7a5e11c9e0b5e9e39f82419a.jpg) 6.看一看数据 [<img src="https://images.seebug.org/upload/201301/09094837d454c6b49fc20eed8ba16abf43f7b72e.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094837d454c6b49fc20eed8ba16abf43f7b72e.jpg) ### 漏洞证明： o(︶︿︶)o 唉~~ SNS的用户数据就这么不安全么……? [<img src="https://images.seebug.org/upload/201301/09094837d454c6b49fc20eed8ba16abf43f7b72e.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094837d454c6b49fc20eed8ba16abf43f7b72e.jpg) [<img src="https://images.seebug.org/upload/201301/09094650d22ae91e7a5e11c9e0b5e9e39f82419a.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201301/09094650d22ae91e7a5e11c9e0b5e9e39f82419a.jpg)