安全研究
CVE-2024-22144 WordPress GOTMLS Plugin 代码注入：20 万安装量的字符串拼接漏洞
Thinking
2024-01-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
WordPress GOTMLS 插件（20 万+ 活跃安装）未对用户输入做参数化，攻击者通过简单字符串拼接就能在服务器上跑任意 PHP。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237687cd8b2e6c0cc05eab1aeba7181a43c726128fc0177fb295cd44a554413ac8b6a4c574ef9fd20fd14256300cf91b8c44cd258248c3bf4203ab63f4b6f10dad255a105ed0951b594683d755c8cd29690229d6e3f467b964d6e52887571a694cf74ae9da25ed42d891da2148253b14c29c8c02b2d9d09f13f5b0472129a0da0b3709f98447ff0e5d32f407a90202026b1ab13b0b165fac845550b5259e889675f4b70a4dce35a949ee6c0d7344586a0472b1a2cacbec637544609ed345035bc8a4a879db5e76f01d9a1bb7fa66eb9f8f339512588993d06a28e44cc3f90c47e31612ab82af2251cd658f60dd24e43233cdf634fb60ee67585389c4dad9607816c5a842464e0dbc8db64208efaf9d4bcded343f7ab4dd3db874f6c2f77a093b68f2ff3a18dfd6d215c32b19aaa694034e427a83c64180f4af7327ffb509892f1919afd4d22c4d5cafe0ba81770a78306961d282b20753f679d8aaf31e2bd4a1d4b451277239b311b33d4035c38f062cc4652695053c6492e74257eb89fe2a53175ebbc9d4ddbd9da41f8c3ad6442b4dd85de6ad283c32b1fcc6ff86c6586849d0620587cc9908e132e6955a0ce36a3c0d86d9cb1a732c5d84c1b68dc80b013c088301b23b43c0225d927eb821ef035c368401cac2f97e3a251ae9226604ea8a8666b58e0081dbba12d88cf2b5d09c56b76071257d1719653a289d77121faa236e9ac78e4409aff54308386fea10568d02c73e9a54212e07ab2626555f8f0f35a3ff99a36f2e360312d5275d4bd8f21ed99472a6241ca522b8e98962053d42319c7e67440b30f397bbb95b62e7f298bc6e6f29165b9dab264871b70767c2992a265cbe24bcece29e16cf74c098ecafaf49a926b2557ee13157c6358b15cac1d5914d879cc9e55080f7b7e841d8c29356b6fb49395c3e981101616bef8dc00c4a7a5f1c9a4c4b3d570a2210fb93fed1467a161c9367359ec6935bd2d62f45abe8ad4048533c2f59ff4e5ca56b657cb03514c27fa188b2edbdf81d17d4e395ffc70a7eb884494a5d9dc1fd459de7e64b3f2003b8f4ec1de40ab157600530bb0a28c6a019b002354c5818898609505f929fb3747834282a60a2e85ac0de64b2145a7e3407800bf2f04742dce2c506dde05c36f4a8f5c2d16a671fb5e95d106f86e9a8ca7f0bdb90c0cacde7ad86e98a82ed84f15cbc7e4ef4d753fe901ce850ed1d6b50b0cac003d0ff98b48547123387b0f65bc884724441c0271c75aa5b872f3127000c3f38c5f0164ecd7ba96b3c301b4798fce112545b8e2dce14508223bd328e80969ba07169559a2e85e7837e3a5f79e0f9d150711fec2672aa05d0479b631f27d8ff80d7580ca5e5a9d728b7dfabf7ceb09109e52d51a719939dad2c53eba806780b2c75349bc8886679c8181eeba72648aaf2fb17a668bd73a90f158fd97ca3f7d508e5fc7f926b09b0ba183cdb2f6d52374caac320408b7a9acad31dc04a1decb829f825f583f728f12a514ee09bd4db69979dff6b518932c1a38d82a404df5167caa82feb9b9c255846bb307eef1fbc9cbc7b04c360926a3983c04f844039cfceb955594545d9c31749806c705c6001ac76dbaa6f68de41aa3f115b68e4cb42d9d94a4dfbcb279442dac68250b94be976f6265f42c9cb0e355566147827a72c3bee06e861d46594a6227e26e49fdbf7542a0e3c23b51b456dacc87498ed3f0cab93aee5e796d2c0c98256dddbf03308b2ba3994ec351f20c834ccd61b12e856854178ff04b8f3ea1fc3918e84522f06da6fa80518123c080a82e143662bfe0f65447c68edbaa448217f3774964c9c6204b50cb2b7481f4b07e82c81d3c7478988212791103970a6c3682dbfbceeb1ca8e0e893cfddf912f13fdc3ca3afe92cb8f63eeb6ce32a46ce458859a8b5b8ceee29ac3a352d9cf03191cb9fbdab0ec138258b143f9dd6a718cbc28888e62e56c321886bac98c37dfdb9cc3e7dac2fdca7e404a797d275c628fcf154d780a135e35a644c7436411ca89987b49b7e3ed2c632e0c961a4f4f568aace7e9745ed40efb8a6161730036770e9e0aa487890d8215e7304bad3af88083546e8707ddbc5a3d08387807ffa69fe815fc0f2369fde2af50e2efc365d98a3d92afdf146f9c236c0d6a725f854898da9988b2c53fb660a48af3fa5dfa7e7b7dca177582895e1a617e618812f46009a4f3276ba38b8aea484c394acc40b6db6e6939755525c6fe206cb0a07cadf46ac968215a6b4ff206a9b073a31e823ee8f8e561f432cbf8625a7761419d1dabc9484527308493f44c13fcf084a26b487de40de1c982801bf5bfa118cd36deccb7b9291a37b2d102164f2d4e94e1cefb876d8ec53ff809b5c596148665e920524ccf26ac1e88d5c4531f468f39d5aca5ba9574f747cdebc94ca484c78b19b603aba083272c73e2108ceec76da3c35139eab21b319f3a3f972a9a852eb0c7b0c12e4ad24fd71cf375b79e8c05a84d80a2fd8754ef0eb080ea61c8b98b9a339cf56815f5e46f82cacbc74a0357f50598484bd97d5e16326f3ba3d2e9d27db9f8e7a0286ef34c08b4b77463ab04adbd246d78d7846b5d75277423f817c3d082adc4fe2332a21be3b164a04470a533d4b16608233f4804e4a47e259d8f747a94a4e2ff67e5f5c2eb7d1c82f9c96347673b37c18217d1195cd074ba179f2784daecf7907592ba7f63d05c199c871f117c95b79ad94dfad6010c6c6df3c2ad15d70dd62227f7a3f13e217c58316edd9377a5e4826ea6ee069aac8f76f2b02b2645d2949b3f2881a120a7d609f4d73ce2ba9c178bbc3c9bcfa14394542f6a8f2840c4db0cdba764163be8069944ed0df847ba28c9555bdaf850fd7c09dda0b769a9ab4ce5d06c53fe452e8752278fcfb3645d48a1ac5da64c706ae7d812054f28102316956c4b0b55e90d5750da5f7ca534dbd177aeea4d33bbd73c7de5fa0f9d4060021e3c1f0746171bb7a3da40b3ce45aae026c8727bb947896d00f61c59172cad085e3b74d165452f5871252835c3916de7728e86a000f7ad1c88d4727ae3c96e4315e4f54dc404a4c3cf39cf12497a31e2e9c53c3e828a6ad08207c96752fce4d7623ff30bdc751e1227d6c94e19df85eb888b17682b8edc5631e09b53adc583e67a473772551c182aedc2a2e20edb9b0e5432b2c4237fad0b94578783f6ed7be55dfaace2cc7c6da1c275ae9fae61c41707848bd259c7b936bde3b0f0abca0184d4db752fe3c9151f084acbadfddd47c30b3deed25c5de55ed6c0d53ad9bccc87dfaef7544405e0510f9ba91d6c3f471e4e7401eff45557faa1844080c6c67211408d64edf6b933b7eab3ab4f9aa889d18e7e2a750d17a3d644aaf6a71bbf888524ad5f34dcbf1549848c42a38ba44ef6aa6a15b67cc4ba709d2fe3329320fcdc8e71219389bca379314ec632c0a4bb4abe3aa3b7a94c0d1ff84c8fd604b6800f28c8cf34856f652a76f1ef137d0cc9dfb7881b744d5cffc2ca04a09ce2adf2cba53eb6391526ffd2429c5a523d84155e2161924f74f71220d4925143276e5e4118d4be05ce913a9574770afcabe2392afc8f754d091d8780a27f274b6ac5cfd2867faea48785bbbb6c8525de85dbde1a687464a560bddebfc26c8faaa8b2b072b63e04322e7d122dd4eb2ff2b5970c3e0ef0eecbdf51bd0227624767b31db01d1502f97e7ab8c26dc923e49b069f7fc878970b442c4c6201aee9f52268a835030378fb862a54a7c30e799bdf8b76fc1cdcb3a2e6218c72cf0493f8068fdf7a59497e667a02fe10df50e87b0f0be71fd383899a82fc2627c86188797ada7c20a7b2dffb7e5747f2ec091a9081840eefe7a103efdea5bc38886ac8dbb1108fdbe23d55a63b29f69c26ac21d70910cb24fb642b7b17c9a3502e7d8186be55c89af287ae9f805e4750adfda810c244d88f8aab5afe1b115fd1c537b7854cf494ed646081eae5830db7ac8aa78f0fa56cc252aeeb49e1742df43721d8489f47ce2729e4120f249cb48bf9141905d9e69e6660de670da2011665c012c7cd0b79ec89b2f6a7b759a3f532c395e05f01c562674ad9d0f4935ed60bac60765962525c6f2f7bf335045f39c10ae81858957878f5bd8fc756076c4e1b29f436eb14f46b9432b475ffe712cf693fb07ca80e2349d05ebcf55781f712957e695835342cfbfc89c1077b76c40e4005234104ad4a6549c5104100a8dcb70a4d27cbeca4d538ba498b5eb5c5d0fa6dc76e68b50a5ac3b5a4d3aad416d3fc5f16db26f96c1204e257e175b6491b421dd3a37a779a13cd73c1c37d288f0460e5eca7fa0433f74c2aa3a13f7afdb8602cabfbac0fcb8df9c4d94db3a0156af57b5e0a05dec9823b630977d025c4b8aff2aea7ee0e559a571eec5bb29db6fed4e1c9948fccf5022fc1a8ef132ffb10c537ff58c8d59cf86ce990db90c0c7a06bac1b0c297cd472a3333c81f9f8a8ae938b7fe1549b1b8476249e974f21f1f0ff0052f97a5a87edf5a39908e64decfb9805d249561aa62255808be98612081154af6740ba42c3f38b7f70bc9bcca130a0f3b3557183e075329d700cd808f1da279ac9bd6ef1da13386f39935a7e234e9997cd5389b51381f7c95f64a4dd4172a82a85faa502e1f378abb567beb7a14e1032750dc1c71edf87b5e8b4c53f3047fe1b60465d0a531ad03e71fbca4dfa082b4aed994ad6c43bd5ef19e384a4151e40371a3a88fdacf9e5307575c11e857110f736266a9ceb607a2691b9ad15ec465c7d8ba705ba9750b322935f5c3a00dbeef5dffcc79231d7134e26d20222d3da561ec8dd534212f6424797d9041e8ccc4711070bdcacd4a2df6d8b4e696ee3dacbc7a823976b4992f694dc8af6fef83d4fd25b050c620615dc61afd062c66eabad5b6bdc3aebbcbdc0cf671cb5d75ee21605cacf67b31b7087d3b16988103906d33148523d2cc68c744c5e36339624dc52f0c43434b32045ac0ef7a8383257641454ee7e8bb6b2ac530f951180fb0b9e06a112db7f0ce438c5a1cf604bbf63068ebd47bb75fcb296aacd595693ae24fafc1952c33b9bb7db2d0a9e89667c249fcc0aa786763a4e4f64452e27716e04a4908181fd23c5f3130fae44d8bb89fbf3f850fccc47f940ae836c44f5231650211f908709cc99491f6c67b2ae85fd1499e6d1294f14ab71fbcbf6ed05709b3f9d982a95899b1bc444a835c99803f43b3cce3d5d14352f883a527936db3325a0ec44e6cb8c382e1407442f5024ae571b9110aea80a06de4c7e1a59ce6eaf83019c3904324a306c21038f7567ebf461001d1f36ccda8d97139a690572a0ca364dc351cdb09135e8209cfd02248ef4643613050f1fd6e9c9e6565ea5fd8a465e80d4a990fcf3424a300404021e0e2852a4edddf71ccbaa40d98b648f8347790a1f57aaedae39d7cbfaa47f3408358a18ccd42dfac34900909aceb11f585196535a14714a0239fb16d867b3f48907a70a130ccc3338b32c929d5b0e8cbafc9bbf3f0160f68cf7db430a78e9dc46578a2a604403bee8368ce5078e33b9404fe497913be79b0a84c70a2fa7a90f15f4e0b8a29500820b1bc5fbc690617db23520f85971d13f8cf796dc4f16ecc1360e09e4a33b440fb6e2c9ae543aa657c7158a7c1f8979c5b57613567d016fcdbc31fc34945b49ea27d89db0261a968f4635eefca99cc70f19cc7cb127b9e02bc7ad8fecd0d664e86c190a6173203371ea595eadbaf10fdfc5199cb4aefc2f973e4c394647a2b1b0e677fd653b6d1fa3d2fdbd32f427f8f7864cf87ca7f7728b5346f2c312eae82e2d4127ed85784c813e27715b29499cefc14ad6e615bb53bc17ea17378b4fc4131a07e85424030874ba096f6c5c06564130fa11b84b0ea2152e0430bf2c49f37ed3a44142b7907935514b8663b1bbd1753c37862add2cd885062d1826f5c43fddc694c1bbb3d58e6944c468061bab8a39b65e3248970fb474327259f9359583a1a1be6966877195ee47ab7502e36e50fe017e665c09255e03e6649e5d247178198515caf08fcdd0d4925b12266f1090a3293ec0feb265707aa6ebc26c45d160b06e6d260f0501f2531e86c025143c33cfb5e9db1cee51b8db953cb175fa9217d3b79be9be07180828fea5e8da9861d99e1b14d5fa5f7bd26ec058baf7a44a1cd63f1f5e873a2c80fcd38dbba6e3cc02261a822c1506338e59711e15f523e2cdcef74f5b2adb9ba584b26e8849809a410fc4de51e594e89c4da95b29ac4c6990dd79dde06d085791e77f720ee7813a3e0854d71da23312d677876542fa67153014ab63e076d4a05655ae62cf32d823093071170fb584ee852e657a38d29da30f847fb687a10a774214c42ea52fcfca28d6acb7892084c965d052f362edc5d6e62acfd8cc00c6db131cd4933ecee47c7ad0bda1aeb2e71eac9904049b30261a018cfde7a9dae01531d59dd022e1e242160b994e469550a3a67f615c7c072691a7b73f01217182d69d6c6f6f5d77074deedf977ce378656e43a12b8c8df3cfd91126ed8fbb821e35ba26e45aa7634e4dc7cccd8ef802fceb0fab90c7af7872c06b04c8b91d9e400321c97d5c82bcce67deb3c0c614314bd50153cfe71cb0275e2388480709d42ca241bc1b51bd73f6777df81f3beef43d9238fda46565c1bcc4511aa96d5edbedbba78fea670ffd1de6d3d510c3ef50c1cc4f8c37f12eabc7ad0010085a62fe90d57d055ab56f9881ef7eb75c9a7656cf3f8ec9f103b8d2162ebb0d23c245625eb9b69341256a11f918a953149ddb1aaf34b013db743ddf059e06ad4da5cda1903528a3bd8ff1e17e2966460791c4d7c9d451a0cb39dac41e3576cdf0edb77fc067b2eeae534e18bc7a021599dd11b0cd3a87339bdf9f3e298c1741406f47ace3aabf3e2462c8b6f54a853da1410c2c5256d5b2d187f816e48ce9ecb6be91cd6afffd3138df44f4e7524491a6d70d95946b0d609bdcdbd0fff588eba3eaf7a9e1556ada0ee20409b04ae60b407f837f2b0758653c3085f6923fffae0d45a7a9fba52c5bb2ab009335be263de45a