CVE-2019-16113 PoC — Bludit 路径遍历漏洞

Source

https://github.com/Kenun99/CVE-2019-16113-Dockerfile

Associated Vulnerability

Title:Bludit 路径遍历漏洞 (CVE-2019-16113)
Description:Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Readme

# Bludit目录穿越漏洞（CVE-2019--16113）

Bludit-3.9.2 是轻量级 CMS，只需要 LAMP 环境便可运行。在图片上传时，Bludit检查文件后缀名后没有及时删除文件，攻击者还可以通过控制uuid参数实现目录穿越。具体[参考](https://github.com/bludit/bludit/issues/1081)

## 漏洞环境

执行如下命令编译镜像并启动Bludit容器

```bash
cd Docker
sudo docker build -t bludit:cve . # 编译镜像
sudo docker run --name bludit -p 8000:80 -d bludit:cve #启动容器，服务在8000端口
```

访问`http://your-ip:8000`创建账户。

利用该漏洞需要注册一个可编辑博客的用户。需要登录Bludit注册用户。假设当前环境下用户为`admin`-`bupt123`

## 漏洞复现

POC[参考自](https://github.com/hg8/CVE-2019-16113-PoC),主要是修改了图片马内容。
攻击机监听8080端口，POC上传图片马实现RCE，反弹shell，攻击机成功获取shell。
![web1poc](https://github.com/Kenun99/CVE-2019-16113-Dockerfile/blob/master/README.assets/web1poc.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →