74CMS存储型XSS跨进后台可GetShell

来源

http://wooyun.org/bugs/wooyun-2014-060037

漏洞详情

贡献者 Knownsec 共获得 0KB

### 简要描述： ~~ ### 详细说明： 1、先来看存储型XSS跨进后台在申请链接处，文件/link/add_link.php ``` elseif ($act=="save") { $captcha=get_cache('captcha'); $postcaptcha = trim($_POST['postcaptcha']); if($captcha['verify_link']=='1' && empty($postcaptcha)) { showmsg("请填写验证码",1); } if ($captcha['verify_link']=='1' && strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0) { showmsg("验证码错误",1); } if ($_CFG['app_link']<>"1") { showmsg('已停止自助申请链接，请联系网站管理员！',1); } else { $setsqlarr['link_name']=trim($_POST['link_name'])?trim($_POST['link_name']):showmsg('您没有填写标题！',1); $setsqlarr['link_url']=trim($_POST['link_url'])?trim($_POST['link_url']):showmsg('您没有填写链接地址！',1); $setsqlarr['link_logo']=trim($_POST['link_logo']); $setsqlarr['app_notes']=trim($_POST['app_notes']); $setsqlarr['alias']=trim($_POST['alias']); $setsqlarr['display']=2; $setsqlarr['type_id']=2; $link[0]['text'] = "返回网站首页"; $link[0]['href'] =$_CFG['site_dir']; !inserttable(table('link'),$setsqlarr)?showmsg("添加失败！",0):showmsg("添加成功，请等待管理员审核！",2,$link); } } ``` 对链接信息没有过滤直接进入数据库。在后台显示时，文件/admin/admin_link.php if($act == 'list') { get_token(); check_permissions($_SESSION['admin_purview'],"link_show"); require_once(QISHI_ROOT_PATH.'include/page.class.php'); $oederbysql=" order BY l.show_order DESC"; $key=isset($_GET['key'])?trim($_GET['key']):""; $key_type=isset($_GET['key_type'])?intval($_GET['key_type']):""; if ($key && $key_type>0) { if ($key_type===1)$wheresql=" WHERE l.link_name like '%{$key}%'"; elseif ($key_type===2)$wheresql=" WHERE l.link_url like '%{$key}%'"; } else { !empty($_GET['alias'])? $wheresqlarr['l.alias']=trim($_GET['alias']):''; !empty($_GET['type_id'])? $wheresqlarr['l.type_id']=intval($_GET['type_id']):''; if (is_array($wheresqlarr)) $wheresql=wheresql($wheresqlarr); } if ($_CFG['subsite']=="1" && $_CFG['subsite_filter_links']=="1") { $wheresql.=empty($wheresql)?" WHERE ":" AND "; $wheresql.=" (l.subsite_id=0 OR l.subsite_id=".intval($_CFG['subsite_id']).") "; } $joinsql=" LEFT JOIN ".table('link_category')." AS c ON l.alias=c.c_alias "; $total_sql="SELECT COUNT(*) AS num FROM ".table('link')." AS l ".$joinsql.$wheresql; $page = new page(array('total'=>$db->get_total($total_sql), 'perpage'=>$perpage)); $currenpage=$page->nowindex; $offset=($currenpage-1)*$perpage; $link = get_links($offset, $perpage,$joinsql.$wheresql.$oederbysql); $smarty->assign('link',$link); $smarty->assign('page',$page->show(3)); $smarty->assign('upfiles_dir',$upfiles_dir); $smarty->assign('get_link_category',get_link_category()); $smarty->assign('navlabel',"list"); $smarty->display('link/admin_link.htm'); } 看看get_link函数： ``` function get_links($offset, $perpage, $get_sql= '') { global $db; $row_arr = array(); $limit=" LIMIT ".$offset.','.$perpage; $result = $db->query("SELECT l.*,c.categoryname FROM ".table('link')." AS l ".$get_sql.$limit); while($row = $db->fetch_array($result)) { $row_arr[] = $row; } return $row_arr; } ``` 直接取出显示，没有过滤，导致xss。我们来申请链接：http://localhost/74cms/link/add_link.php [<img src="https://images.seebug.org/upload/201405/09132900622c6a715fd1a38acfc403572f117ef0.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/09132900622c6a715fd1a38acfc403572f117ef0.png) 后台管理员查看申请链接时：http://localhost/74cms/admin/admin_index.php [<img src="https://images.seebug.org/upload/201405/09133004ed5ae2c9a037b48df70446216ab4e294.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/09133004ed5ae2c9a037b48df70446216ab4e294.png) 2、后台GetShell 我们首先可以在前台上传一个头像jpg文件，文件内容: ``` <?php phpinfo();?> ``` 上传后的文件路径为： http://localhost/74cms/user/personal/personal_index.php 查看头像属性： [<img src="https://images.seebug.org/upload/201405/091333299bf02ac8a414114887c57862fdf1aa28.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/091333299bf02ac8a414114887c57862fdf1aa28.png) 通过第一步拿到的cookie登陆后台。后台工具——计划任务——添加任务：任务脚本就填我们上传的头像图片路径：../../data/avatar/100/2014/05/09/1.jpg 然后提交即可。此时在网站首页刷新页面，得到结果： [<img src="https://images.seebug.org/upload/201405/09133647fbb9415c2b90ac4717c51150918ea387.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/09133647fbb9415c2b90ac4717c51150918ea387.png) 3、总结通过上面的XSS和后台的GetShell 我们可以全部自动化，由于后台有csrf防御，我们可以先通过xss获取到后天的csrftoken，然后构造getshell的js文件，在来一次xss就搞定了。 ### 漏洞证明：见详细说明。

简要描述：

~~

详细说明：

1、先来看存储型XSS跨进后台在申请链接处，文件/link/add_link.php

elseif ($act=="save")
{    
    $captcha=get_cache('captcha');
    $postcaptcha = trim($_POST['postcaptcha']);
    if($captcha['verify_link']=='1' && empty($postcaptcha))
    {
        showmsg("请填写验证码",1);
     }
    if ($captcha['verify_link']=='1' &&  strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0)
    {
        showmsg("验证码错误",1);
    }
    if ($_CFG['app_link']<>"1")
    {
    showmsg('已停止自助申请链接，请联系网站管理员！',1);
    }
    else
    {
    $setsqlarr['link_name']=trim($_POST['link_name'])?trim($_POST['link_name']):showmsg('您没有填写标题！',1);
    $setsqlarr['link_url']=trim($_POST['link_url'])?trim($_POST['link_url']):showmsg('您没有填写链接地址！',1);
    $setsqlarr['link_logo']=trim($_POST['link_logo']);
    $setsqlarr['app_notes']=trim($_POST['app_notes']);
    $setsqlarr['alias']=trim($_POST['alias']);
    $setsqlarr['display']=2;
    $setsqlarr['type_id']=2;
    $link[0]['text'] = "返回网站首页";
    $link[0]['href'] =$_CFG['site_dir'];
    !inserttable(table('link'),$setsqlarr)?showmsg("添加失败！",0):showmsg("添加成功，请等待管理员审核！",2,$link);
    }
}

对链接信息没有过滤直接进入数据库。在后台显示时，文件/admin/admin_link.php if($act == 'list') { get_token(); check_permissions($_SESSION['admin_purview'],"link_show"); require_once(QISHI_ROOT_PATH.'include/page.class.php'); $oederbysql=" order BY l.show_order DESC"; $key=isset($_GET['key'])?trim($_GET['key']):""; $key_type=isset($_GET['key_type'])?intval($_GET['key_type']):""; if ($key && $key_type>0) {

    if     ($key_type===1)$wheresql=" WHERE l.link_name like '%{$key}%'";
    elseif ($key_type===2)$wheresql=" WHERE l.link_url like '%{$key}%'";
}
else
{
!empty($_GET['alias'])? $wheresqlarr['l.alias']=trim($_GET['alias']):'';
!empty($_GET['type_id'])? $wheresqlarr['l.type_id']=intval($_GET['type_id']):'';
if (is_array($wheresqlarr)) $wheresql=wheresql($wheresqlarr);
}
    if ($_CFG['subsite']=="1" && $_CFG['subsite_filter_links']=="1")
    {
        $wheresql.=empty($wheresql)?" WHERE ":" AND ";
        $wheresql.=" (l.subsite_id=0 OR l.subsite_id=".intval($_CFG['subsite_id']).") ";
    }
$joinsql=" LEFT JOIN ".table('link_category')." AS c ON l.alias=c.c_alias  ";
$total_sql="SELECT COUNT(*) AS num FROM ".table('link')." AS l ".$joinsql.$wheresql;
$page = new page(array('total'=>$db->get_total($total_sql), 'perpage'=>$perpage));
$currenpage=$page->nowindex;
$offset=($currenpage-1)*$perpage;
$link = get_links($offset, $perpage,$joinsql.$wheresql.$oederbysql);
$smarty->assign('link',$link);
$smarty->assign('page',$page->show(3));
$smarty->assign('upfiles_dir',$upfiles_dir);
$smarty->assign('get_link_category',get_link_category());
$smarty->assign('navlabel',"list");
$smarty->display('link/admin_link.htm');

} 看看get_link函数：

function get_links($offset, $perpage, $get_sql= '')
{
    global $db;
    $row_arr = array();
    $limit=" LIMIT ".$offset.','.$perpage;
    $result = $db->query("SELECT l.*,c.categoryname FROM ".table('link')." AS l ".$get_sql.$limit);
    while($row = $db->fetch_array($result))
    {
    $row_arr[] = $row;
    }
    return $row_arr;    
}