wordpress /wp-content/plugins/wp-symposium/server/php/UploadHandler.php File Arbitrary Upload Vul
2023-09-27 14:28:11 时间
catalog
1. 漏洞描述 2. 漏洞触发条件 3. 漏洞影响范围 4. 漏洞代码分析 5. 防御方法 6. 攻防思考
1. 漏洞描述
Relevant Link:
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
/wp-content/plugins/wp-symposium/server/php/UploadHandler.php
function __construct($options = null, $initialize = true, $error_messages = null) { if (isset($_POST['uploader_uid']) && isset($_POST['uploader_url'])) { $upload_dir = $_POST['uploader_dir']; $upload_url = $_POST['uploader_url']; $this->options = array( 'script_url' => $this->get_full_url().'/', 'upload_dir' => $upload_dir, 'upload_url' => $upload_url, 'user_dirs' => false, 'mkdir_mode' => 0755, 'param_name' => 'files', // Set the following option to 'POST', if your server does not support // DELETE requests. This is a parameter sent to the client: 'delete_type' => 'DELETE', 'access_control_allow_origin' => '*', 'access_control_allow_credentials' => false, 'access_control_allow_methods' => array( 'OPTIONS', 'HEAD', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE' ), 'access_control_allow_headers' => array( 'Content-Type', 'Content-Range', 'Content-Disposition' ), // Enable to provide file downloads via GET requests to the PHP script: 'download_via_php' => false, // Defines which files can be displayed inline when downloaded: 'inline_file_types' => '/\.(mp4|zip|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png)$/i', // 允许任意后缀文件上传,这是漏洞的根源 'accept_file_types' => '/.+$/i', ..
5. 防御方法
/wp-content/plugins/wp-symposium/server/php/UploadHandler.php
.. // Enable to provide file downloads via GET requests to the PHP script: 'download_via_php' => false, // Defines which files can be displayed inline when downloaded: 'inline_file_types' => '/\.(mp4|zip|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png)$/i', /**/ 'accept_file_types' => '/.(mp4|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png)$/i', /**/ ..
6. 攻防思考
Copyright (c) 2015 LittleHann All rights reserved
相关文章
- Rotate Always Encrypted keys using SQL Server Management Studio
- Server.Transfer VS Response.Redirect – Simplified
- 本地搭建MongoDB Server
- Host is not allowed to connect to this MySQL server
- Windows Server 2008通过计划任务定时执行bat文件
- Kafka报错——log问题导致ERROR Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.
- import cv2出现“ImportError: DLL load failed: 找不到指定的模块” python3.7.4 windows server 2012 r2
- ADBport被占用,adb server is out of date
- php连接mysql8.0报错,Server sent charset unknown to the client. Please, report to the developers
- 【转】sql server内存分析,sql server磁盘分析,sql serverop分析
- (4.5)sql server授权/权限操作/查看权限,权限控制