| 제목 | JPress CMS Remote Command Execution Vulnerability |
|---|
| 설명 | JPress is a WordPress like product developed in Java that supports automatic switching between multiple sites and languages.
JPress is an open-source and free site building artifact developed in Java, inspired by WordPress. At present, more than 10w+websites have been built using JPress, including many government agencies, 200+listed companies, Chinese Academy of Sciences, Red Cross Society, etc.
There is a system plug-in interface that can be uploaded in the background of JPress. Specifically, it is uploaded by jar package or zip. Java code contains the test class of the uploaded plug-in. We can construct a malicious jar package and upload it to the system server, and access the interface of the test class to trigger parsing, thus causing remote command execution.
This vulnerability can be used to execute server system commands and obtain system information.
Vulnerability address: http://ip:8080/admin/addon/test
Code download address: https://gitee.com/JPressProjects/jpress.git
Vulnerability location: upload the plug-in function node after logging into the system. |
|---|
| 원천 | ⚠️ https://github.com/Ha0Liu/cveAdd/blob/developer/JPress远程命令执行/JPress%20CMS%20Remote%20Command%20Execution%20Vulnerability.md |
|---|
| 사용자 | ha0l (UID 35011) |
|---|
| 제출 | 2022. 11. 23. AM 09:47 (4 연령 ago) |
|---|
| 모더레이션 | 2022. 11. 24. PM 02:56 (1 day later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 192332 [JPress 4.2.0 JAR Package HelloWorldAddonController.java 권한 상승] |
|---|
| 포인트들 | 0 |
|---|