Walks

网络安全爱好者

代码审计:FineCMS5.0.8 前台任意文件上传

前言:

代码审计学习中,复现几个Finecms的漏洞。

漏洞分析:

第一处:

《代码审计:FineCMS5.0.8 前台任意文件上传》

当我们上传在前台注册一个账号并且上传头像的时候,发出的包如上图。首先,这些数据我们是可以控制的

《代码审计:FineCMS5.0.8 前台任意文件上传》

然后我们在看下后台对这些数据是如何处理的,$file=POST过来的tx,然后用正则匹配,我们看到那么正则了么。问题就出在这里

我们正则过后的文件后缀等于$result[2],而这个值就是tx数据data:image/jpg中的jpg,这个参数上面也说过我们是可以控制的,

文件内容的话就是result[1],这个数据我们也是可以控制,所以我们等同于控制了文件后缀和文件内容。这样我们是不是可以上传任意文件了呢?

路径如下图:

《代码审计:FineCMS5.0.8 前台任意文件上传》

《代码审计:FineCMS5.0.8 前台任意文件上传》

 

第二处:

这个跟上面一样,也是任意文件上传,但是存在不一样的地方

出问题的就是个这data2函数,我们先看一下

《代码审计:FineCMS5.0.8 前台任意文件上传》

《代码审计:FineCMS5.0.8 前台任意文件上传》

看到没。一样是那个跟新头像的正则出现问题了,我们上面也说过,post 的数据我们是可以控制的,所以我们还是可以上传任意文件,但这里我们要用到sys_key,不过这个值是固定的。看下图

《代码审计:FineCMS5.0.8 前台任意文件上传》

漏洞危害:

1:任意文件上传任意文件,等同于获得网站权限,一句话菜刀或者大马都可以。如果配置不当或许可提权。

2:后来的版本已修复,修复思路是对文件后缀加了个检测,如果不是白名单之中的后缀则退出。

点赞
  1. nfl store说道:

    Thanks so much for providing individuals with a very memorable chance to discover important secrets from this blog. It is always very good and stuffed with fun for me and my office co-workers to visit the blog no less than three times per week to read the latest tips you will have. Of course, I'm just at all times fascinated with your powerful guidelines served by you. Selected 3 ideas in this article are basically the most suitable we have all had.

  2. I needed to post you that very little note to help say thanks a lot over again relating to the awesome secrets you've discussed in this case. It was really seriously open-handed of people like you to grant extensively precisely what a lot of folks might have marketed as an electronic book to help make some dough on their own, most importantly seeing that you could possibly have tried it if you ever considered necessary. Those tricks also acted to become a easy way to know that other people have a similar interest just as mine to grasp more and more when it comes to this condition. Certainly there are several more pleasant sessions in the future for many who read through your site.

  3. hyperdunks说道:

    I would like to voice my gratitude for your kindness for folks who have the need for guidance on this one study. Your special commitment to getting the message all through appears to be particularly effective and has really helped somebody just like me to arrive at their desired goals. The useful publication implies a whole lot a person like me and additionally to my office colleagues. With thanks; from all of us.

  4. air max 90说道:

    My wife and i got absolutely delighted when Ervin could deal with his survey through your ideas he gained using your blog. It's not at all simplistic to simply be freely giving solutions which usually the rest could have been trying to sell. And we all do know we've got the blog owner to give thanks to for this. The entire explanations you made, the easy blog navigation, the relationships you will give support to promote - it is many great, and it is facilitating our son and us understand this concept is awesome, which is unbelievably pressing. Thanks for all!

  5. pure boost说道:

    I am just writing to make you know of the notable encounter my cousin's girl found reading through your web page. She noticed a good number of pieces, most notably how it is like to have an incredible teaching spirit to make certain people with ease comprehend specified grueling topics. You actually surpassed our desires. Many thanks for rendering those invaluable, dependable, informative as well as cool guidance on that topic to Evelyn.

  6. I as well as my pals ended up checking the excellent tactics on your web blog and all of the sudden got a terrible feeling I had not expressed respect to you for them. All of the women were absolutely thrilled to study all of them and already have clearly been taking pleasure in these things. Appreciate your indeed being quite kind as well as for finding some smart information most people are really desperate to understand about. My honest regret for not expressing gratitude to you earlier.

  7. off-white说道:

    My wife and i felt absolutely fulfilled when Louis could round up his research by way of the precious recommendations he received out of your blog. It is now and again perplexing to simply possibly be giving out concepts other folks may have been selling. And we do know we have got the writer to thank because of that. Those explanations you have made, the straightforward website menu, the friendships your site assist to engender - it's everything incredible, and it's really facilitating our son in addition to the family believe that that article is pleasurable, which is pretty indispensable. Many thanks for the whole lot!

  8. yeezy boost 350说道:

    I would like to convey my affection for your kind-heartedness giving support to individuals who require guidance on in this theme. Your real commitment to passing the message all around has been surprisingly functional and has usually made guys and women just like me to achieve their targets. Your own helpful hints and tips signifies this much a person like me and far more to my peers. With thanks; from everyone of us.

  9. I want to get across my passion for your kindness giving support to individuals that require assistance with that study. Your personal dedication to passing the solution all-around turned out to be definitely good and have frequently encouraged somebody just like me to attain their desired goals. The helpful facts implies a whole lot to me and much more to my peers. With thanks; from all of us.

  10. longchamp说道:

    I am writing to let you know of the wonderful discovery my friend's girl enjoyed going through your web site. She came to understand such a lot of things, which included what it is like to possess a wonderful giving style to let the mediocre ones with no trouble gain knowledge of certain complicated issues. You truly exceeded my desires. Many thanks for producing those useful, healthy, educational not to mention unique guidance on the topic to Kate.

  11. nmd说道:

    My husband and i were absolutely more than happy that Emmanuel could complete his survey by way of the ideas he came across using your weblog. It's not at all simplistic to just be giving away tips and tricks which often other people might have been making money from. And we also take into account we have got the blog owner to give thanks to because of that. The specific explanations you made, the simple website menu, the friendships you make it easier to create - it is many amazing, and it's facilitating our son and us understand the subject is pleasurable, and that is really mandatory. Thank you for all the pieces!

  12. I'm also commenting to make you understand of the perfect discovery our girl undergone browsing your webblog. She even learned numerous pieces, including what it is like to have an incredible helping mood to get other people really easily understand selected advanced topics. You undoubtedly exceeded readers' expectations. Many thanks for distributing these important, trustworthy, revealing and as well as unique tips on the topic to Ethel.

  13. supreme clothing说道:

    I wanted to write down a small word so as to say thanks to you for those fabulous points you are sharing here. My time-consuming internet investigation has now been honored with extremely good tips to share with my contacts. I 'd express that many of us visitors actually are really lucky to dwell in a superb network with very many perfect individuals with very helpful pointers. I feel quite fortunate to have discovered your site and look forward to tons of more excellent moments reading here. Thank you once more for everything.

  14. timberland shoes说道:

    I intended to compose you this little bit of word so as to thank you the moment again regarding the pretty pointers you've featured on this website. It has been shockingly generous of people like you to give extensively exactly what a few people could have offered for sale for an ebook to help with making some dough for themselves, most notably seeing that you might well have done it if you ever wanted. The solutions also acted like the easy way to know that many people have the same dream the same as mine to realize a lot more pertaining to this matter. I am certain there are many more pleasant times in the future for individuals who look over your website.

  15. air max说道:

    My spouse and i have been really joyous when Jordan could deal with his preliminary research via the ideas he obtained in your web site. It's not at all simplistic just to find yourself offering guides which some other people may have been making money from. We see we now have the writer to appreciate for this. The type of explanations you've made, the easy web site menu, the friendships you aid to foster - it is mostly fabulous, and it's really assisting our son in addition to us imagine that the issue is thrilling, and that is pretty indispensable. Many thanks for the whole thing!

  16. adidas yeezy说道:

    I have to show my appreciation to the writer just for rescuing me from this problem. As a result of exploring through the the web and getting concepts that were not productive, I believed my life was over. Existing minus the approaches to the issues you've resolved all through this report is a crucial case, and the kind which could have badly damaged my entire career if I hadn't noticed the website. That capability and kindness in controlling the whole lot was excellent. I am not sure what I would have done if I hadn't come upon such a subject like this. It's possible to at this moment relish my future. Thank you very much for this professional and amazing guide. I will not think twice to recommend your web blog to anybody who needs and wants guidance about this topic.

  17. moncler outlet说道:

    Thank you for all of the effort on this web site. Gloria take interest in participating in investigations and it is simple to grasp why. Most people hear all relating to the powerful way you convey advantageous guidance through your blog and as well foster participation from the others on that issue plus our princess has been learning so much. Take advantage of the remaining portion of the year. Your performing a glorious job.

  18. Thanks a lot for providing individuals with a very nice chance to read from here. It is always very pleasurable plus packed with a great time for me and my office mates to visit your blog at a minimum three times in a week to see the latest guidance you have. Of course, I'm just certainly happy with the superb principles you give. Certain 1 points in this article are rather the most effective we have had.

  19. goyard bags说道:

    I enjoy you because of your own labor on this site. Debby delights in managing research and it's easy to understand why. We notice all about the dynamic way you offer very important things via the web blog and as well inspire participation from visitors about this content plus our own daughter is without a doubt being taught a lot of things. Have fun with the remaining portion of the year. You are always performing a first class job.

  20. I am only writing to make you be aware of of the brilliant discovery my wife's princess found reading your web site. She discovered several things, which included what it is like to have an awesome helping heart to let the rest clearly completely grasp a variety of advanced subject areas. You really exceeded her desires. Thank you for providing the important, healthy, informative as well as unique tips about that topic to Jane.

  21. converse outlet说道:

    My wife and i were so comfortable when John managed to finish up his web research through your ideas he had when using the web pages. It is now and again perplexing to simply always be handing out helpful hints which some other people could have been selling. We really figure out we now have you to thank for this. All the explanations you've made, the straightforward web site navigation, the relationships you give support to instill - it is everything impressive, and it's really making our son and the family consider that this situation is fun, which is certainly quite vital. Many thanks for the whole thing!

  22. air max 270说道:

    I intended to put you that tiny observation so as to say thank you over again over the stunning techniques you have documented above. It's simply wonderfully open-handed with you to convey freely precisely what a number of us would've supplied as an e-book to end up making some cash on their own, even more so seeing that you might well have done it if you wanted. These good ideas as well acted to provide a great way to recognize that someone else have the identical dreams like my own to know very much more in regard to this matter. Certainly there are numerous more enjoyable opportunities up front for individuals that take a look at your site.

  23. reebok outlet说道:

    I simply had to say thanks yet again. I'm not certain what I would've sorted out without the entire aspects revealed by you directly on that area. It absolutely was a very alarming circumstance for me, but coming across your specialized tactic you processed that forced me to leap with happiness. Extremely thankful for this assistance and hope you really know what an amazing job you are carrying out training most people through the use of a web site. More than likely you've never encountered any of us.

  24. golden goose说道:

    I wish to show appreciation to the writer for bailing me out of this particular matter. Right after looking out through the world wide web and getting notions which are not productive, I thought my life was over. Being alive without the strategies to the difficulties you have solved by way of your main report is a crucial case, and those that would have negatively damaged my entire career if I had not discovered your web page. Your competence and kindness in playing with all the stuff was excellent. I am not sure what I would've done if I had not come across such a thing like this. I'm able to at this point relish my future. Thanks very much for the high quality and results-oriented guide. I will not be reluctant to suggest your web blog to any individual who should receive direction on this subject.

  25. longchamp bags说道:

    My wife and i have been really fulfilled when Peter could conclude his survey through the ideas he obtained through the web site. It is now and again perplexing just to possibly be handing out tips which other folks might have been selling. And now we grasp we've got the blog owner to give thanks to because of that. The explanations you made, the easy website menu, the friendships you make it easier to promote - it is all awesome, and it is leading our son and us understand the topic is exciting, and that's extremely fundamental. Many thanks for the whole lot!

  26. golden goose说道:

    I'm just writing to let you understand of the fine experience my wife's child developed browsing your blog. She learned many pieces, which include what it is like to possess an excellent teaching mindset to have others clearly know precisely a variety of hard to do topics. You truly did more than her expected results. Thanks for producing the insightful, trusted, informative and in addition unique thoughts on the topic to Gloria.

  27. jordan retro说道:

    Thanks so much for providing individuals with an extraordinarily superb possiblity to read articles and blog posts from this web site. It can be so superb and also full of a good time for me and my office co-workers to visit the blog minimum 3 times in 7 days to learn the latest items you will have. And of course, we're certainly satisfied for the dazzling tactics served by you. Selected two tips on this page are clearly the very best we have had.

  28. jordan 4说道:

    I simply wanted to thank you so much all over again. I am not sure what I would've created in the absence of the ways revealed by you concerning such situation. It had become a real distressing crisis for me, however , discovering the professional mode you resolved it took me to jump with gladness. Extremely grateful for this advice and in addition wish you are aware of a great job you are always accomplishing training most people through a blog. I am certain you've never got to know any of us.

  29. yeezy 500 blush说道:

    I am only writing to let you understand of the really good encounter my princess gained studying your webblog. She came to understand a good number of things, which included what it's like to have a wonderful giving mindset to get many people quite simply master chosen grueling subject matter. You undoubtedly surpassed my expected results. I appreciate you for providing the insightful, dependable, edifying and in addition unique tips on the topic to Ethel.

  30. cat boots说道:

    I simply wanted to compose a brief note so as to thank you for those splendid secrets you are posting here. My considerable internet search has at the end of the day been recognized with professional know-how to go over with my company. I 'd assume that many of us readers are unquestionably endowed to be in a wonderful website with very many lovely individuals with very beneficial strategies. I feel somewhat privileged to have encountered your weblog and look forward to many more exciting moments reading here. Thank you again for all the details.

  31. yeezy说道:

    I wish to get across my affection for your generosity supporting those individuals that have the need for help with this particular concept. Your real dedication to passing the message around appeared to be astonishingly insightful and have without exception enabled guys and women just like me to achieve their goals. Your new informative suggestions denotes a whole lot to me and further more to my colleagues. Many thanks; from all of us.

  32. red bottom shoes说道:

    I would like to express appreciation to the writer just for bailing me out of this type of instance. Right after researching through the world wide web and finding methods that were not helpful, I was thinking my entire life was done. Existing devoid of the approaches to the issues you've solved by way of the review is a serious case, as well as ones that might have negatively damaged my entire career if I hadn't noticed your web site. Your good know-how and kindness in taking care of almost everything was crucial. I'm not sure what I would have done if I had not encountered such a thing like this. It's possible to now look forward to my future. Thanks for your time so much for the professional and result oriented guide. I won't think twice to endorse your blog post to anyone who desires recommendations about this problem.

  33. nike polo shirts说道:

    I simply wanted to write down a small comment so as to thank you for all the amazing guidelines you are placing on this website. My extended internet lookup has at the end of the day been rewarded with extremely good know-how to exchange with my colleagues. I would say that most of us readers actually are definitely lucky to dwell in a perfect community with very many awesome people with beneficial hints. I feel really blessed to have come across your entire website page and look forward to so many more cool moments reading here. Thanks once more for all the details.

  34. Thank you so much for giving everyone such a superb chance to read critical reviews from this website. It is always very enjoyable and as well , full of amusement for me personally and my office fellow workers to visit your site on the least three times in 7 days to read through the newest stuff you will have. Not to mention, I'm actually fulfilled with all the stunning information you serve. Certain 4 facts in this posting are completely the very best we have ever had.

  35. yeezy boost说道:

    I truly wanted to jot down a small word so as to thank you for all the amazing concepts you are sharing at this website. My long internet look up has at the end been paid with good quality facts to talk about with my pals. I would say that we readers actually are very much fortunate to dwell in a useful community with very many marvellous people with beneficial principles. I feel extremely fortunate to have encountered your weblog and look forward to many more pleasurable minutes reading here. Thanks once again for a lot of things.

  36. yeezy 700说道:

    Thanks so much for giving everyone an extremely spectacular chance to read in detail from this web site. It's usually very good and also packed with a great time for me personally and my office co-workers to visit your web site the equivalent of 3 times in a week to read through the latest stuff you have got. And indeed, I'm so always motivated considering the remarkable hints served by you. Selected 1 ideas in this post are basically the very best I have had.

  37. I am writing to make you know of the remarkable encounter our child gained browsing the blog. She discovered many pieces, with the inclusion of what it is like to possess a wonderful helping spirit to make other people very easily know just exactly a number of advanced issues. You undoubtedly exceeded my expected results. Thanks for giving the beneficial, safe, revealing and also unique tips about your topic to Sandra.

  38. michael kors说道:

    Thank you so much for giving everyone an exceptionally pleasant opportunity to read critical reviews from this site. It can be so terrific and as well , stuffed with a lot of fun for me and my office peers to search the blog the equivalent of thrice per week to learn the newest issues you will have. And of course, I'm always fulfilled with the mind-boggling methods served by you. Selected 4 ideas in this post are truly the very best I have had.

  39. kyrie 4说道:

    I actually wanted to develop a simple comment to be able to appreciate you for all the splendid guides you are sharing at this website. My extended internet research has at the end been recognized with professional facts and strategies to write about with my pals. I 'd assert that many of us readers are unequivocally lucky to be in a good network with very many perfect professionals with valuable guidelines. I feel pretty grateful to have come across your entire site and look forward to tons of more amazing minutes reading here. Thanks a lot again for a lot of things.

  40. I must express some appreciation to you for rescuing me from such a scenario. As a result of looking throughout the world wide web and finding things which are not beneficial, I assumed my life was done. Being alive devoid of the answers to the difficulties you have solved by means of your good website is a serious case, as well as the ones that would have badly damaged my entire career if I hadn't discovered your site. Your primary knowledge and kindness in controlling every item was precious. I don't know what I would've done if I hadn't encountered such a solution like this. It's possible to at this moment look ahead to my future. Thanks very much for your high quality and result oriented help. I won't think twice to refer your blog to anybody who desires guide about this matter.

  41. Off White Jordan说道:

    Yeezy Shoeshttp://www.yeezy.com.co/
    Yeezyhttp://www.yeezys.us.com/
    Yeezy Shoeshttp://www.yeezysupply.us.com/
    Yeezy Shoeshttp://www.yeezy-shoes.us.com/
    Yeezy Boost 350http://www.yeezy-boost350.com/
    Yeezy Boost 350 V2http://www.yeezyboost350.us.com/
    Yeezy Blue Tinthttp://www.yeezybluetint.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.com/
    Yeezy 500http://www.yeezy500utilityblack.us/
    Vapor Maxhttp://www.vapor-max.org.uk/
    Salomon Shoeshttp://www.salomon-shoes.org.uk/
    Salomonhttp://www.salomons.me.uk/
    Salomon Shoeshttp://www.salomonspeedcross4.org.uk/
    Off White Air Jordan 1http://www.offwhitejordan1.com/
    Vapor Maxhttp://www.nikevapormax.org.uk/
    React Element 87http://www.nikereactelement87.us.com/
    Nike Element 87http://www.nikereactelement87.us/
    Nike Plushttp://www.nikeplus.us/
    Nike Outlet Storehttp://www.nike--outlet.us/
    Nike Outlet Store Online Shoppinghttp://www.nikeoutletstoreonlineshopping.us/
    Nike Outlethttp://www.nikeoutletonlineshopping.us/
    Nike NBA Jerseyshttp://www.nikenbajerseys.us/
    Air Max 97http://www.nikeairmax.us/
    Nike Air Max 2017http://www.max2017.us/
    Air Jordan Shoeshttp://www.jordan-com.com/
    Jordan 11 Concord 2018http://www.jordan11-concord.com/
    Cheap Yeezy Shoeshttp://www.cs7boots1.com/
    Cheap NBA Jerseys From Chinahttp://www.cheapnba-jerseys.us/
    Birkenstock Sandalshttp://www.birkenstocksandalsuk.me.uk/
    NBA Jerseyshttp://www.basketball-jersey.us/
    Balenciaga UKhttp://www.balenciaga.me.uk/
    Balenciagahttp://www.balenciagauk.org.uk/
    Balenciaga UKhttp://www.balenciagatriples.org.uk/
    Balenciaga UKhttp://www.birkenstocks.me.uk/
    Balenciaga UKhttp://www.balenciagatrainers.org.uk/
    Nike Air Maxhttp://www.airmax270.org.uk/
    Adidas Yeezyshttp://www.adidasyeezyshoes.org.uk/
    Adidas Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/

发表评论

电子邮件地址不会被公开。 必填项已用*标注