### 简要描述：
因某函数的过滤不严，导致存在存储型XSS
### 详细说明：
第一处XSS漏洞：
问题存在于 ：
```
http://localhost/thinksaas/index.php?app=group&ac=create&ts=do
```
我们看看代码
```
//执行创建小组
case "do":
if($TS_APP['options']['iscreate'] == 0 || $TS_USER['user']['isadmin']==1){
if(intval($_POST['grp_agreement']) != 1){
tsNotice('不同意社区指导原则是不允许创建小组的！');
}
$groupname = t($_POST['groupname']);
$groupdesc = tsClean($_POST['groupdesc']);
if($groupname=='' || $groupdesc=='') {
tsNotice('小组名称和介绍不能为空！');
}
//过滤内容开始
aac('system')->antiWord($groupname);
aac('system')->antiWord($groupdesc);
//过滤内容结束
//配置文件是否需要审核
$isaudit = intval($TS_APP['options']['isaudit']);
if($TS_USER['user']['isadmin']==1){
$isaudit = 0;
}
$isGroup = $new['group']->findCount('group',array(
'groupname'=>$groupname,
));
if($isGroup > 0) {
tsNotice("小组名称已经存在，请更换其他小组名称！");
}
$groupid = $new['group']->create('group',array(
'userid' => $userid,
'cateid'=>intval($_POST['cateid']),
'cateid2'=>intval($_POST['cateid2']),
'cateid3'=>intval($_POST['cateid3']),
'groupname' => $groupname,
'groupdesc' => $groupdesc,
'isaudit' => $isaudit,
'addtime' => time(),
));
//上传
$arrUpload = tsUpload($_FILES['picfile'],$groupid,'group',array('jpg','gif','png'));
if($arrUpload){
$new['group']->update('group',array(
'groupid'=>$groupid,
),array(
'path'=>$arrUpload['path'],
'photo'=>$arrUpload['url'],
));
}
//绑定成员
$new['group']->create('group_user',array(
'userid'=>$userid,
'groupid'=>$groupid,
'addtime'=>time(),
));
//更新
$count_group = $new['group']->findCount('group_user',array(
'userid'=>$userid,
));
$new['group']->update('user_info',array(
'userid'=>$userid,
),array(
'count_group'=>$count_group,
));
//更新小组人数
$new['group']->update('group',array(
'groupid'=>$groupid,
),array(
'count_user'=>1,
));
//更新分类统计
$cateid = intval($_POST['cateid']);
if($cateid > 0){
$count_group = $new['group']->findCount('group',array(
'cateid'=>$cateid,
));
$new['group']->update('group_cate',array(
'cateid'=>$cateid,
),array(
'count_group'=>$count_group,
));
}
header("Location: ".tsUrl('group','show',array('id'=>$groupid)));
}
break;
```
$groupdesc 是由 tsClean 函数进行过滤的，来看看此函数代码
```
/**
* 过滤脚本代码
* @param unknown $text
* @return mixed
*/
function cleanJs($text) {
$text = trim ( $text );
//$text = stripslashes ( $text );
// 完全过滤注释
$text = preg_replace ( '/<!--?.*-->/', '', $text );
// 完全过滤动态代码
$text = preg_replace ( '/<\?|\?>/', '', $text );
// 完全过滤js
$text = preg_replace ( '/<script?.*\/script>/', '', $text );
// 过滤多余html
$text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text );
// 过滤on事件lang js
while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) {
$text = str_replace ( $mat [0], $mat [1], $text );
}
while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) {
$text = str_replace ( $mat [0], $mat [1] . $mat [3], $text );
}
return $text;
}
```
只对一些标签和属性进行了过滤
因此 $_POST['groupdesc'] 可以插入XSS
构造个XSS代码
```
<marquee onscroll=alert(1)></marquee>
```
看以下的漏洞证明，代码执行了
[<img src="https://images.seebug.org/upload/201405/11131426f9576f9fa0cbb88b98261eb5ab6f1f9e.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/11131426f9576f9fa0cbb88b98261eb5ab6f1f9e.jpg)
第二处XSS漏洞：
问题存在于 : http://localhost/thinksaas/index.php?app=photo&ac=edit&ts=do
```
case "do" :
if ($_POST ['token'] != $_SESSION ['token']) {
tsNotice ( '非法操作！' );
}
$articleid = intval ( $_POST ['articleid'] );
$strArticle = $new ['article']->find ( 'article', array (
'articleid' => $articleid
) );
if($strArticle['userid']!=$userid){
tsNotice('非法操作！');
}
$cateid = intval ( $_POST ['cateid'] );
$title = tsClean ( $_POST ['title'] );
$content = tsClean ( $_POST ['content'] );
```
tsClean过滤不严导致 $title 和 $content可以插入XSS
构造XSS代码
`<marquee onscroll=alert(1)></marquee> `
### 漏洞证明：
第二处访问相册的时候会触发
[<img src="https://images.seebug.org/upload/201405/11132140b7e702db483b5e135229364d16bcff5f.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/11132140b7e702db483b5e135229364d16bcff5f.jpg)
京公网安备 11010502034610号
暂无评论