| शीर्षक | PHPEMS PHPEMS 6/7 验证绕过 && RCE |
|---|
| विवरण | The encryption and decryption logic of PHPEMS Session uses a Key to encrypt and decrypt Session data. However, there are loopholes in the encryption and decryption algorithm. The key can be restored externally through calculation. By obtaining this key, you can forge data and send it to the server for deserialization. During deserialization, you can find the chain and perform SQL injection operations, thereby tampering with the database and forging an administrator session. After logging in, enable the topic module and edit the template to execute malicious code. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/jw4Hp9cq7T69 |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 07/12/2023 07:15 PM (3 साल पहले) |
|---|
| संयम | 09/12/2023 09:40 PM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 247357 [PHPEMS 6.x/7.x/8.x/9.0 Session Data lib/session.cls.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|