### 简要描述: TinyRise 邮件欺诈可重置任何人密码和后台sql注射 ### 详细说明: simple.php: ``` public function forget_act(){ $email = Filter::sql(Req::args('email')); $model = $this->model->table('user'); $obj = $model->where("email = '".$email."'")->find(); if(!empty($obj)){ $model = $this->model->table('reset_password'); $obj = $model->where("email = '".$email."'")->find(); $safecode = md5(md5($email).md5(CHash::random(32))); if(!empty($obj)){ $obj['safecode'] = $safecode; $model->data($obj)->update(); } else{ $model->data(array('email'=>$email,'safecode'=>$safecode))->add(); } $url = Url::getHost().Url::urlFormat("/simple/reset_password/safecode/$safecode"); $html = ''; $html .='<p>亲爱的用户:</p>'; $html .='<p>感谢您注册'.$this->site_name.',请点击以下链接重置您的密码。<br/><br/>'; $html .="<a href='{$url}' target='_blank'>{$url}</a><br/><br/>"; $html .='愿您在'.$this->site_name.'度过愉快的时光。<br/><br/>'; $html .="<a href='".Url::getHost().Url::urlFormat('/')."'>".$this->site_name."</a></p>"; echo $html; exit; $mail = new Mail(); $flag =...
### 简要描述: TinyRise 邮件欺诈可重置任何人密码和后台sql注射 ### 详细说明: simple.php: ``` public function forget_act(){ $email = Filter::sql(Req::args('email')); $model = $this->model->table('user'); $obj = $model->where("email = '".$email."'")->find(); if(!empty($obj)){ $model = $this->model->table('reset_password'); $obj = $model->where("email = '".$email."'")->find(); $safecode = md5(md5($email).md5(CHash::random(32))); if(!empty($obj)){ $obj['safecode'] = $safecode; $model->data($obj)->update(); } else{ $model->data(array('email'=>$email,'safecode'=>$safecode))->add(); } $url = Url::getHost().Url::urlFormat("/simple/reset_password/safecode/$safecode"); $html = ''; $html .='<p>亲爱的用户:</p>'; $html .='<p>感谢您注册'.$this->site_name.',请点击以下链接重置您的密码。<br/><br/>'; $html .="<a href='{$url}' target='_blank'>{$url}</a><br/><br/>"; $html .='愿您在'.$this->site_name.'度过愉快的时光。<br/><br/>'; $html .="<a href='".Url::getHost().Url::urlFormat('/')."'>".$this->site_name."</a></p>"; echo $html; exit; $mail = new Mail(); $flag = $mail->send_email($email,'找回密码--'.$this->site_name,$html); if($flag){ $this->assign('status','success'); } ``` 这里我退出exit,打印出来了要用户确认邮件的内容 现在这里的host是否可以伪造呢 跟进getHost(): ``` public static function getHost($http='http') { if(self::$_host!==null) return self::$_host; if(isset($_SERVER['HTTP_HOST'])) self::$_host = $http.'://'.$_SERVER['HTTP_HOST']; else self::$_host = $http.'://'.$_SERVER['SERVER_NAME']; return self::$_host; } ``` 这里是来自于$_SERVER的内容 那么这样一来我们就能控制邮件所要发送的地方 [<img src="https://images.seebug.org/upload/201410/231856416a78d95ec5ab5db6534bada207a42abe.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/231856416a78d95ec5ab5db6534bada207a42abe.png) 这样一来 用户的邮箱将要收到一封确认函,当他点击的时候这个里面的 index.php?con=simple&act=reset_password&safecode=1904683da46f62cae0cf5aa271ddfa57 这个东西将会发送到passwordreset.net 的这个站点 那么下来我们重置只需要把host换回来,就行了 下来我们看后台sql注入地方: content.php: ``` public function article_del() { $id = Req::args('id'); if(is_array($id)){ $ids = implode(',', $id); } else $ids = $id; $model = new Model("article"); $articles = $model->where("id in ($ids)")->findAll(); $str = ''; exit; foreach ($articles as $article) { $str .= $article['title'].'、'; } $str = trim($str,'、'); $model->where("id in ($ids)")->delete(); if($articles){ Log::op($this->manager['id'],"删除文章","管理员[".$this->manager['name']."]:删除了文章 ".$str); $msg = array('success',"成功删除文章 ".$str); $this->redirect("article_list",false,array('msg'=> $msg)); }else{ $this->redirect("article_list"); } } ``` 这里获取到的$id = Req::args('id'); 没有做任何处理 直接进入到了$articles = $model->where("id in ($ids)")->findAll(); 这样的例子太多了 而且这个是一个select的sql,root会写shell的 ok........................... ### 漏洞证明: