Getshell Vulnerability Analysis in case of enterprise-level CMS

Getshell Vulnerability Analysis in case of enterprise-level CMS

Yiqicms is a well-known website construction system for Marketing Enterprises in China. It is developed based on PHP + MySQL. Free open-source, SEO friendly. Recently, Alibaba's patch monitoring platform Diviner has detected the vulnerability of yiqicms in Getshell under specific circumstances.

0x01 background

Programs with this vulnerability come from Versions earlier than yiqicms1.8, which can trigger the Getshell vulnerability in some Web suites.

0x02 Analysis

<? Phperror_reporting (E_ALL ^ E_NOTICE); header ("content-type: text/html; charset = UTF-8"); require_once '.. /include/file. class. php '$ step = $ _ GET ["step"]; $ action = $ _ POST ["action"]; if ($ action = "save ") // install. lock is similar to the Mechanism verification mechanism. The installation process may cause reinstalling {$ dbhost =$ _ POST ["dbhost"]; $ dbname =$ _ POST ["dbname"]; $ dbuser = $ _ POST ["dbuser"]; $ dbpass =$ _ POST ["dbpass"]; $ dbprefix =$ _ POST ["dbprefix"]; $ adminuser = $ _ POST ["Username"]; $ adminpass =$ _ POST ["userpass"]; if (empty ($ dbpass )){.... Omit several rows $ dbpass = "" ;}$ configsource = "<? Php \ n \ $ mongo_db_host = \ "$ dbhost \"; \ n ". $ dbhost uses the "Number" to input malicious data to $ configsource by inserting a special password or database name .... Omit several rows... "\ N?> "; If (file_exists (".. /include/config. inc. php ") {rename (" install. php "," install. php. bak "); // install. rename php. bak. You can directly use install. php. install Getshell} $ filedata-> writefile (".. /include/config. inc. php ", $ configsource); // write data directly to/include/config. inc. php Getshell. Exit ("<script> window. location = 'Install. php? Step = finish '; </script> ") ;}?>

0x03 Exploitation

When the server has the iis 7.0/7.5 or nginx malformed Parsing Vulnerability, you can directly access/install. php. bak/. php to reactivate the installation. Then, use a special password to close the file and implant malicious code into/include/config. inc. php.

0x04 repair

Currently, the official version 1.8 has fixed this vulnerability. Please download the latest version of the CMS (1.8 commemorative version ).

If you want to upgrade the 1.8 version to the 1.8 commemorative version, please download the 1.8 commemorative version patch.