There is a File upload vulnerability that can getshell

[lavon321]

The file upload vulnerability here lies in the blacklist method used when verifying the suffix of the uploaded file. This verification method is not strict and is often bypassed by attackers in various ways
The PluginsUpload method in the application\service\PluginsAdminService.php file has a file creation operation, in which the input of the file_put_contents function is controllable

Line 1072 checks the file suffix name, here is the blacklist check

The value in the private static variable $exclude_ext is ‘.php’, which can easily be bypassed

There are many ways to bypass the blacklist verification of suffix names. Taking my local Windows system environment as an example, you can upload file names that do not conform to the Windows file naming rules

shell.php::$DATA
shell.php::$DATA…….
shell.php.
shell.php(空格)
shell.php:1.jpg

The windows system will automatically remove the content behind the symbols that do not conform to the rules. You can change the file suffix in the linux environment and upload it to the website
Through the audit of the PluginsUpload method in the PluginsAdminService.php file
When the zip archive does not match the resource directory, it will jump out of the loop of reading the archive file



And the resource directory cannot be controller, because the directory corresponding to controller exists, and the compressed package will be closed directly without entering the subsequent file writing operation

Finally, the method is called in the Upload method of the application\admin\controller\Pluginsadmin.php file

The attacker can upload such a compressed package after logging into the background system

And upload the compressed package at Application Center -> Application Management -> Upload Application

Visit public\static\upload\file_uploadfile_\shell.php

In application\service\ThemeService.php there is also the same blacklist verification problem for uploaded files

The processing logic is very similar to the above file
After logging in to the system, upload the zip archive at the site management -> theme management -> theme installation

Visit public\static\index\test.php after uploading