Description
PHPOK是一套支持扩展的企业建站系统。 PHPOK 4.9.032版本中的framework/admin/modulec_control.php文件的‘import_f’函数存在任意文件上传漏洞。攻击者可利用该漏洞上传任意的zip文件。
PHPOK 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/mushangqiujin/p/18523242
https://blog.csdn.net/weixin_42582241/article/details/104593164
https://www.yxlink.com/index_safetyresearch_read_id_107.html
https://zhuanlan.zhihu.com/p/616278574
https://nvd.nist.gov/vuln/detail/CVE-2018-12491
https://avd.aliyun.com/detail?id=AVD-2021-34076
https://bugs.leavesongs.com/php/phpok%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0getshell%EF%BC%88%E5%AE%98%E7%BD%91%E5%B7%B2shell%EF%BC%89/
https://cloud.tencent.com/developer/article/1587015
https://www.hantaosec.com/3554.html
https://vulners.com/seebug/SSV:97155