A P2P online lending system foreground getshell and Arbitrary File Deletion Vulnerability (may involve a large amount of financial security)

A P2P online lending system foreground getshell and Arbitrary File Deletion Vulnerability (may involve a large amount of financial security)

Boom ~

Detailed description:

/Www/Public/uploadify. php

/* Uploadify background processing * // sets the upload directory error_reporting (E_ALL &~ E_NOTICE &~ E_DEPRECATED); $ path = "uploads /". $ _ GET ['folder']. "/"; if ($ _ GET ['file _ delete']) {// delete if (file_exists ('. '. $ _ GET ['file _ delete']) {// The image unlink ('. '. $ _ GET ['file _ delete']); // delete it} if (! Empty ($ _ FILES) {// get the uploaded temporary file stream $ tempFile = $ _ FILES ['filedata'] ['tmp _ name']; // allowed file suffixes $ fileTypes = array ('jpg ', 'jpeg', 'gif', 'png '); // obtain the file name $ fileParts = pathinfo ($ _ FILES ['filedata'] ['name']); $ ftype = $ fileParts ['extension']; $ fileName = microtime (true ). ". ". $ fileParts ['extension']; // name it in microseconds // Save the server address if (! Is_dir ($ path) mkdir ($ path); if (move_uploaded_file ($ tempFile, $ path. $ fileName) {echo $ fileName;} else {echo $ fileName. $ _ FILES ['filedata'] ['tmp _ name']. "Upload Failed! ";}}?>

No permission settings, and $ fileTypes does not see the call.

Submit $ _ GET ['file _ delete'] to delete any file.

Construct a form locally

Getshell.

Proof of vulnerability:

Case 1:

Http://www.pjzx123.com/

1.3 billion .. I don't know .. Reject water meter query --

Http://www.pjzx123.com/Public/uploadify/uploads/201509/1442254529.7142.php

Case 2:

Http://hm.bjdjyx.com/

Millions.

Http://hm.bjdjyx.com//Public/uploadify/uploads/1442254710.5383.php

Case 3:

Http://www.yunzew.com/

More than 0.1 million.

Http://www.yunzew.com//Public/uploadify/uploads/1442254745.36.php

4:

Http://www.aft-sunnyit.com//Public/uploadify/uploads/1442254784.43.php

5:

Http://www.fangdaibao.cc/Public/uploadify/uploads/1442254831.3598.php

Solution:

Determine permissions. Check suffix!