乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-24: 细节已通知厂商并且等待厂商处理中 2015-04-28: 厂商已经确认,细节仅向厂商公开 2015-05-01: 细节向第三方安全合作伙伴开放 2015-06-22: 细节向核心白帽子及相关领域专家公开 2015-07-02: 细节向普通白帽子公开 2015-07-12: 细节向实习白帽子公开 2015-07-27: 细节向公众公开
实在不知道这CMS叫啥名字~涉及GOV等站点
某系统任意文件上传导致代码执行涉及不少GOV站点啊~厂商:
http://www.06330633.net/ 东日照和和科技有限公司
Upload Bug:
/adminqibo5/Edit/editor/resurm_upfile.asp 开始我看到adminqibo5还以为齐博CMS 后来发现网上有这套系统的源码
官方也是用这套CMS的,特征是“mucc”、官方有案例:
case: (涉及不少gov,有些gov域名也是)
http://www.06330633.net/adminqibo5/Edit/editor/resurm_upfile.asp 官网也存在http://www.jxweisheng.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asp http://www.xiazhuang.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxxm.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxslj.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxfls.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxclz.gov.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxlyjw.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.ysxywj.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.gmsywj.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.kaidajiaxiao.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.kaida56.cn/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.rzjxxa.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.donghui-steel.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxywj.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.rzhc.net/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxpfz.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxjbkz.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.rzscxh.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.cnhengyuan.net/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.xzh120.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxrmyy.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxbjy.com/adminqibo5/Edit/editor/resurm_upfile.asphttp://www.jxjhfzs.com/adminqibo5/Edit/editor/resurm_upfile.asp
这个系统的漏洞和动感购物商城的漏洞原理是一个样子的,通过00截断上传目录可导致上传任意文件,所以使用明小子动感购物商城exp就可以直接getshell,我测试其中一个案例:
1、返回的文件名是diy.asp
危害等级:高
漏洞Rank:15
确认时间:2015-04-28 09:45
CNVD确认并复现所述情况,已经转由CNCERT下发给相应分中心,由其后续协调网站管理单位处置。
暂无