QVODCMS V4.0 相关漏洞利用

先是上传: 位于admin/Fckeditor/maxcms_upload.htm maxcms_upload.htm : form name="form" id="form" enctype="multipart/form-data" action="maxcms_upload.asp?act=up" method=post> 调用maxcms_upload.asp maxcms_upload.asp:
 
                        '判断文件类型                         if lcase(up_fileExt)="asp" and lcase(up_fileExt)="asa" and lcase(up_fileExt)="aspx" then                                 CheckFileExt(up_fileExt)=false                         end if                         if CheckFileExt(up_fileExt)=false then                                 response.write "<table><tr><td bgcolor=#E9F5F5>文件格式不正确 [ <a href=# onclick=history.go(-1)>重新上传</a> ]</td></tr></table>"                                 response.end                         end if  
 
很明显过滤了asp asa  aspx ....  so  you know how to use!    php  cer 位于Admin\Fckeditor\editor\qvodcms_editor_server下有FCK不过被改名了 也可用直接访问利用有: frmupload.html frmresourcetype.html frmresourceslist.html frmfolders.html frmcreatefolder.htmlfrmactualfolder.html Data/##QVODCMS4.0.mdb md5加密的 后台路径:admin/ 用户名:qvodcms 密  码:qvodcms 认证码: qvodcms 安全团队 but........ 安全提醒:你必须修改默认后台admin目录名称不然无法输入帐号密码进后台!" so  你需要猜后台。

1 条评论

  1. hill

    过来转转

发表评论