本文揭示了一个存在于CMS系统中的严重安全漏洞，攻击者可通过构造特定URL直接下载服务器上的任意文件，如/etc/passwd。该漏洞涉及Index.php控制器及Http.php中文件下载功能的实现，由于缺乏必要的过滤和保护措施，导致服务器敏感信息泄露风险。
The point of vulnerability is: application/bbs/controller/Index.php
The key code in the figure is for file download
follow in "download",which in extend/org/Http.php
There are no protection measures such as filtering, you can download any file directly
example：
payload：http://127.0.0.1/cms/myucms/index.php/bbs/index/download?url=/etc/passwd&name=1.txt&local=1
Download / etc / passwd on the server and save it as 1.txt
After downloading it opens as shown
Thanks for 0dod
扫一扫
288
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
