关联漏洞
Description
Remote code execution Vulnerability in QloApps (version 1.6.0.0)
介绍
# RCE-QloApps-CVE-2024-40318
A remote code execution (RCE) attack allow an attacker run code on a computer. The ability to execute code could lead to deploying additional malware or stealing sensitive data or even harm the server.
The remote code execution was discover in Qloapps version 1.6.0.0 while the application was being checked in the administrator panel, in the section “Modules and services” where is possible to upload a modified module like “mailchimp-for-prestashop”(https://addons.prestashop.com/en/newsletter-sms/26957-mailchimp-for-prestashop.html”), this allowed to evade the php file upload restriction and get a remote code execution by modifing the file “cronjob.php” and accessing to it through the web browser.
文件快照
[4.0K] /data/pocs/07206532c8c51c9f69b188a2a062a3839bd5f6be
├── [736K] qloapps--RCE.pdf
└── [ 752] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。