Schlix CMS 2.2.6-6 认证远程代码执行漏洞

漏洞总结：Schlix CMS 2.2.6-6 远程代码执行（已认证） 漏洞概述 Schlix CMS 2.2.6-6 版本存在远程代码执行漏洞。攻击者通过上传恶意扩展包（如 扩展），利用 文件中的 函数执行任意系统命令。 影响范围 软件名称: Schlix CMS 受影响版本: 2.2.6-6 平台: 多平台（Windows + WampServer 测试） 认证要求: 需要登录账户（Authenticated） 修复方案 1. 升级至最新安全版本。 2. 避免上传未经验证的扩展包。 3. 禁用或限制 等危险函数的使用。 POC 代码 1. 恶意扩展包内容 ( ) 2. HTTP 请求（ZIP 扩展安装） 3. HTTP 请求（RCE - About Tab） 4. HTTP 响应（RCE - About Tab） ```http HTTP/1.1 200 OK Date: Wed, 05 May 2021 21:49:24 GMT Server: Apache/2.4.46 (Win64) PHP/7.3.21 X-Powered-By: PHP/7.3.21 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: sc2f1afdb4b86ade4919555d446d2f0909=1pv1lrnlepvojoiiepevvn65p2; expires=Wed, 05-May-2021 23:49:24 GMT; Max-Age=7200; path=/; domain=127.0.0.1; HttpOnly; SameSite=Lax Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49575 Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:80 0.0.0.0:0 LISTENING TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP 0.0.0.0:982 0.0.0.0:0 LISTENING TCP 0.0.0.0:912 0.0.0.0:0 LISTENING TCP 0.0.0.0:3306 0.0.0.0:0 LISTENING TCP 0.0.0.0:3307 0.0.0.0:0 LISTENING TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING TCP 0.0.0.0:50296 0.0.0.0:0 LISTENING TCP 127.0.0.1:80 127.0.0.1:58843 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58853 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58854 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58859 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58860 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58865 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58868 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58883 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58884 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58894 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58899 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58902 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58908 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58918 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58919 TIME_WAIT TCP 127.0.0.1:80 127.0.0.1:58924 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58886 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58887 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58888 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58891 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58905 CLOSE_WAIT TCP 127.0.0.1:8080 127.0.0.1:58907 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58911 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58913 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58915 TIME_WAIT TCP 127.0.0.1:8080 127.0.0.1:58916 TIME_WAIT TCP 127.0.0.1:58424 127.0.0.1:58425 ESTABLISHED TCP 127.0.0.1:58425 127.0.0.1:58424 ESTABLISHED TCP 127.0.0.1:58435 127.0.0.1:58435 ESTABLISHED TCP 127.0.0.1:58436 127.0.0.1:58435 ESTABLISHED TCP 127.0.0.1:58565 127.0.0.1:58566 ESTABLISHED TCP 127.0.0.1:58566 127.0.0.1:58565 ESTABLISHED TCP 127.0.0.1:58639 127.0.0.1:58640 ESTABLISHED TCP 127.0.0.1:58640 127.0.0.1:58639 ESTABLISHED TCP 169.254.22.167:139 0.0.0.0:0 LISTENING TCP 169.254.224.26:139 0.0.0.0:0 LISTENING TCP 192.168.1.8:139 0.0.0.0:0 LISTENING TCP 192.168.1.8:49560 95.101.14.77:443 ESTABLISHED TCP 192.168.1.8:57059 162.159.129.235:443 ESTABLISHED TCP 192.168.1.8:57902 162.159.138.234:443 ESTABLISHED TCP 192.168.1.8:58453 44.235.109.138:443 ESTABLISHED TCP 192.168.1.8:58626 162.159.138.232:443 ESTABLISHED TCP 192.168.1.8:58942 162.159.133.234:443 ESTABLISHED TCP 192.168.1.8:58989 162.159.135.232:443 ESTABLISHED TCP 192.168.1.8:58841 20.44.232.74:443 ESTABLISHED TCP 192.168.1.8:58942 162.159.138.232:443 ESTABLISHED TCP 192.168.1.8:58951 138.68.92.190:443 ESTABLISHED TCP 192.168.1.8:60649 51.183.5.159:443 ESTABLISHED TCP 192.168.1.8:60610 104.66.70.197:443 ESTABLISHED TCP 192.168.1.8:60611 104.66.70.197:443 ESTABLISHED TCP 192.168.1.8:60612 217.31.233.104:443 CLOSE_WAIT TCP [::]:80 [::]:0 LISTENING TCP [::]:135 [::]:0 LISTENING TCP [::]:445 [::]:0 LISTENING TCP [::]:3306 [::]:0 LISTENING TCP [::]:3307 [::]:0 LISTENING TCP [::]:7680 [::]:0 LISTENING TCP [::]:49664 [::]:0 LISTENING TCP [::]:49665 [::]:0 LISTENING TCP [::]:49666 [::]:0 LISTENING

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Schlix CMS 2.2.6-6 认证远程代码执行漏洞

目标达成感谢每一位支持者 — 我们达成了 100% 目标！