### 简要描述： CuuMall免费开源商城系统 header欺骗风险 可劫持用户名和密码 ### 详细说明： 直接看代码: loginAction.class.php:(161-192): ``` public function getpassword( ) { $username = $_POST['username']; $mail = $_POST['email']; $us = new Model( "m_member" ); $d_us = $us->where( "username='".$username."'" )->find( ); if ( empty( $d_us ) ) { $this->assign( "waitSecond", 3 ); $this->assign( "msgTitle", "错误！" ); $this->assign( "jumpUrl", "__APP__/home/login/getpass" ); $this->error( "用户名不存在" ); exit( ); } if ( $d_us['email'] != $mail ) { $this->assign( "waitSecond", 3 ); $this->assign( "msgTitle", "错误！" ); $this->assign( "jumpUrl", "__APP__/home/login/getpass" ); $this->error( "认证邮箱不正确！" ); exit( ); } $data['mailstate'] = 1; $us->data( $data )->where( "username='".$username."'" )->save( ); $pass = $d_us['password']; $url = "http://".$_SERVER['SERVER_NAME']."/index.php/home/login/setpass/user/".$username."/pass/".$pass; vendor( "mail.class-phpmailer" ); $title = "=?UTF-8?B?".base64_encode( c( "MALLNAME" )."密码找回" )."?=";...
### 简要描述： CuuMall免费开源商城系统 header欺骗风险 可劫持用户名和密码 ### 详细说明： 直接看代码: loginAction.class.php:(161-192): ``` public function getpassword( ) { $username = $_POST['username']; $mail = $_POST['email']; $us = new Model( "m_member" ); $d_us = $us->where( "username='".$username."'" )->find( ); if ( empty( $d_us ) ) { $this->assign( "waitSecond", 3 ); $this->assign( "msgTitle", "错误！" ); $this->assign( "jumpUrl", "__APP__/home/login/getpass" ); $this->error( "用户名不存在" ); exit( ); } if ( $d_us['email'] != $mail ) { $this->assign( "waitSecond", 3 ); $this->assign( "msgTitle", "错误！" ); $this->assign( "jumpUrl", "__APP__/home/login/getpass" ); $this->error( "认证邮箱不正确！" ); exit( ); } $data['mailstate'] = 1; $us->data( $data )->where( "username='".$username."'" )->save( ); $pass = $d_us['password']; $url = "http://".$_SERVER['SERVER_NAME']."/index.php/home/login/setpass/user/".$username."/pass/".$pass; vendor( "mail.class-phpmailer" ); $title = "=?UTF-8?B?".base64_encode( c( "MALLNAME" )."密码找回" )."?="; $headers = "MIME-Version:1.0\r\n"; $headers .= "Content-type:text/plain;charset=utf-8\r\n"; $headers .= "Content-Transfer-Encoding:8bit\r\n"; $body = c( "MALLNAME" )."用户您好，您于".date( "Y-m-d H:i:s" )."使用了密码找回服务,请点击以下链接修改密码 \n\n".$url."\n\n如果链接无法点击，请将该链接复制到浏览器(如IE)的地址栏中访问。\n如不是您本人操作请删除该邮件！\n本邮件由系统自动发出，请勿回复。"; $html = $body; $mm = new PHPMailer( ); ``` 发现了没有 这里只需要判断两个东西 1.username 2.email 然而发送给客户的邮件是一个链接 这个链接是: $url = "http://".$_SERVER['SERVER_NAME']."/index.php/home/login/setpass/user/".$username."/pass/".$pass; 看到这里我们就想通了 这里的$_SERVER['SERVER_NAME'] 是可以欺骗的 这里我们直接在入口index处打印一下$_SERVER['SERVER_NAME']，重新构造一下host [<img src="https://images.seebug.org/upload/201409/30122501b0a739249ab094f94c35ce96f4b7d06f.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/30122501b0a739249ab094f94c35ce96f4b7d06f.png) 这时候 我们就随便访问一个链接 然后看看这个东西是否可以构造 [<img src="https://images.seebug.org/upload/201409/301229328b5ac7f41073c8eea13f9235b5a33f47.png" alt="8.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/301229328b5ac7f41073c8eea13f9235b5a33f47.png) 这里实际上发送到passwordreset.net 站点了 ，当某某人 好奇心点击一下 密码就被窃取了 原理很简单 ### 漏洞证明：
