提交 #54725: JreCMS template injection vulnerability

The rapid development of JreCMS, dynamic addition of fields, user-defined labels, dynamic creation of database tables and crud data, database backup and restore, dynamic addition of sites (multi site function), and one click generation of template code make it easy to open Build your own independent website, which is also convenient for secondary development, allowing you to quickly build personalized independent websites. Background functions include: Global configuration (configuration parameters, model management) Basic content (website information, company information, content columns) Content management (content data, label management) Extended content (message information, rotating pictures, friendship links, customized tables, customized data) Official account management (WeChat menu) System management (site management, system role, system user, database management, template management, menu management) The JreCMS background management system can add a template file and call the user-defined template file in the column introduction, so that we can edit a template file with malicious command execution and use it in other columns Call to implement a remote command execution vulnerability. This vulnerability can be used to execute server system commands and obtain system information. Vulnerability address: http://ip:8888/admin/template?directory=default Code download address: https://gitee.com/heyewei/SpringBootCMS.git Vulnerability location: after logging in to the system, the template management interface adds the basic content of the template interface, and the content column calls the user-defined template.

• 来源: ⚠️ https://github.com/Ha0Liu/cveAdd/blob/developer/JreCMS%20template%20injection%20vulnerability/JreCMS%20template%20injection%20vulnerability.md
• 用户: muzishouchen (UID 36418)
• 提交: 2022-12-05 04時12分 (4 年前)
• 管理: 2022-12-05 08時08分 (4 hours later)
• 状态: 已接受
• VulDB条目: 214790 [SpringBootCMS Template Management 权限提升]
• 积分: 20