CVE-2018-16370 PoC — PESCMS Team 安全漏洞

Source

https://github.com/snappyJack/CVE-2018-16370

Associated Vulnerability

Title:PESCMS Team 安全漏洞 (CVE-2018-16370)
Description:PESCMS Team是一款使用PHP语言编写的开源团队任务管理系统。 PESCMS Team 2.2.1版本中存在安全漏洞。攻击者可通过在ZIP归档文件中放置.php文件并借助/Public/?g=Team&m=Setting&a=upgrade页面利用该漏洞上传并执行任意PHP代码。

Description

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through  /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.

Readme

# CVE-2018-16370
In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through  /Public/?g=Team&amp;m=Setting&amp;a=upgrade by placing a .php file in a ZIP archive.More details see (https://github.com/lazyphp/PESCMS-TEAM/issues/2)

File Snapshot


 [4.0K]  /data/pocs/331ba76906403d4af0a4f08f18f2e3a44cfd31df
└── [ 251]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!