CVE-2020-11546 PoC — SuperWebMailer 注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11546.yaml

Associated Vulnerability

Title:SuperWebMailer 注入漏洞 (CVE-2020-11546)
Description:Superwebmailer是一个基于 Web 的 PHP 通讯软件，用于通讯收件人管理，发送 HTML 通讯，生日电子邮件。 SuperWebMailer 7.21.0.01526版本中的mailingupgrade.php文件的‘Language’参数存在注入漏洞。攻击者可利用该漏洞执行任意的PHP代码。

Description

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.

File Snapshot


 id: CVE-2020-11546

info:
  name: SuperWebmailer 7.21.0.01526 - Remote Code Execution
  author: Offi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!