PHPcms9.6.0 arbitrary file Upload Vulnerability Direct Getshell use tutorial

For PHPcms9.6.0 the latest version of the vulnerability, the specific steps are as follows:

First we build a PHP environment locally, I am here Appserv or use Phpnow (official website: http://servkit.org/)

(As long as you can execute the php file.)

Create a new txt text file in the root directory and write a word in PHP, as you can access

Then we find PHPCMS website registration module, fill in the information casually

Then we grab the bag with Burpsuite.

(Refer to the previous article for Burpsuite tools and related use tutorials: https://www.exehack.net/tag/burp-suite)

and send it to repeater.

We use the IMG tag at the bottom of the register to insert the first step of our local setup.

Only need to modify the IMG inside the link for your local write a word can, and note that in repeater test go every time you want to modify the Username,password and email field values (can not be repeated)

We can see the repeater MySQL query successfully inserted, and then visit the repeater in my yellow statement, execute a sentence

Connecting Chopper, Getshell

PHPcms9.6.0 arbitrary file Upload Vulnerability Direct Getshell use tutorial