### 简要描述： 因某函数的过滤不严，导致存在存储型XSS ### 详细说明： 第一处XSS漏洞： 问题存在于 ： ``` http://localhost/thinksaas/index.php?app=group&ac=create&ts=do ``` 我们看看代码 ``` //执行创建小组 case "do": if($TS_APP['options']['iscreate'] == 0 || $TS_USER['user']['isadmin']==1){ if(intval($_POST['grp_agreement']) != 1){ tsNotice('不同意社区指导原则是不允许创建小组的！'); } $groupname = t($_POST['groupname']); $groupdesc = tsClean($_POST['groupdesc']); if($groupname=='' || $groupdesc=='') { tsNotice('小组名称和介绍不能为空！'); } //过滤内容开始 aac('system')->antiWord($groupname); aac('system')->antiWord($groupdesc); //过滤内容结束 //配置文件是否需要审核 $isaudit = intval($TS_APP['options']['isaudit']); if($TS_USER['user']['isadmin']==1){ $isaudit = 0; } $isGroup = $new['group']->findCount('group',array( 'groupname'=>$groupname, )); if($isGroup > 0) { tsNotice("小组名称已经存在，请更换其他小组名称！"); } $groupid = $new['group']->create('group',array( 'userid'=> $userid, 'cateid'=>intval($_POST['cateid']), 'cateid2'=>intval($_POST['cateid2']), 'cateid3'=>intval($_POST['cateid3']), 'groupname'=>...
### 简要描述： 因某函数的过滤不严，导致存在存储型XSS ### 详细说明： 第一处XSS漏洞： 问题存在于 ： ``` http://localhost/thinksaas/index.php?app=group&ac=create&ts=do ``` 我们看看代码 ``` //执行创建小组 case "do": if($TS_APP['options']['iscreate'] == 0 || $TS_USER['user']['isadmin']==1){ if(intval($_POST['grp_agreement']) != 1){ tsNotice('不同意社区指导原则是不允许创建小组的！'); } $groupname = t($_POST['groupname']); $groupdesc = tsClean($_POST['groupdesc']); if($groupname=='' || $groupdesc=='') { tsNotice('小组名称和介绍不能为空！'); } //过滤内容开始 aac('system')->antiWord($groupname); aac('system')->antiWord($groupdesc); //过滤内容结束 //配置文件是否需要审核 $isaudit = intval($TS_APP['options']['isaudit']); if($TS_USER['user']['isadmin']==1){ $isaudit = 0; } $isGroup = $new['group']->findCount('group',array( 'groupname'=>$groupname, )); if($isGroup > 0) { tsNotice("小组名称已经存在，请更换其他小组名称！"); } $groupid = $new['group']->create('group',array( 'userid'=> $userid, 'cateid'=>intval($_POST['cateid']), 'cateid2'=>intval($_POST['cateid2']), 'cateid3'=>intval($_POST['cateid3']), 'groupname'=> $groupname, 'groupdesc'=> $groupdesc, 'isaudit'=> $isaudit, 'addtime'=> time(), )); //上传 $arrUpload = tsUpload($_FILES['picfile'],$groupid,'group',array('jpg','gif','png')); if($arrUpload){ $new['group']->update('group',array( 'groupid'=>$groupid, ),array( 'path'=>$arrUpload['path'], 'photo'=>$arrUpload['url'], )); } //绑定成员 $new['group']->create('group_user',array( 'userid'=>$userid, 'groupid'=>$groupid, 'addtime'=>time(), )); //更新 $count_group = $new['group']->findCount('group_user',array( 'userid'=>$userid, )); $new['group']->update('user_info',array( 'userid'=>$userid, ),array( 'count_group'=>$count_group, )); //更新小组人数 $new['group']->update('group',array( 'groupid'=>$groupid, ),array( 'count_user'=>1, )); //更新分类统计 $cateid = intval($_POST['cateid']); if($cateid > 0){ $count_group = $new['group']->findCount('group',array( 'cateid'=>$cateid, )); $new['group']->update('group_cate',array( 'cateid'=>$cateid, ),array( 'count_group'=>$count_group, )); } header("Location: ".tsUrl('group','show',array('id'=>$groupid))); } break; ``` $groupdesc 是由 tsClean 函数进行过滤的，来看看此函数代码 ``` /** * 过滤脚本代码 * @param unknown $text * @return mixed */ function cleanJs($text) { $text = trim ( $text ); //$text = stripslashes ( $text ); // 完全过滤注释 $text = preg_replace ( '/<!--?.*-->/', '', $text ); // 完全过滤动态代码 $text = preg_replace ( '/<\?|\?>/', '', $text ); // 完全过滤js $text = preg_replace ( '/<script?.*\/script>/', '', $text ); // 过滤多余html $text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text ); // 过滤on事件lang js while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1], $text ); } while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1] . $mat [3], $text ); } return $text; } ``` 只对一些标签和属性进行了过滤 因此 $_POST['groupdesc'] 可以插入XSS 构造个XSS代码 ``` <marquee onscroll=alert(1)></marquee> ``` 看以下的漏洞证明，代码执行了 [<img src="https://images.seebug.org/upload/201405/11131426f9576f9fa0cbb88b98261eb5ab6f1f9e.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/11131426f9576f9fa0cbb88b98261eb5ab6f1f9e.jpg) 第二处XSS漏洞： 问题存在于 : http://localhost/thinksaas/index.php?app=photo&ac=edit&ts=do ``` case "do" : if ($_POST ['token'] != $_SESSION ['token']) { tsNotice ( '非法操作！' ); } $articleid = intval ( $_POST ['articleid'] ); $strArticle = $new ['article']->find ( 'article', array ( 'articleid' => $articleid ) ); if($strArticle['userid']!=$userid){ tsNotice('非法操作！'); } $cateid = intval ( $_POST ['cateid'] ); $title = tsClean ( $_POST ['title'] ); $content = tsClean ( $_POST ['content'] ); ``` tsClean过滤不严导致 $title 和 $content可以插入XSS 构造XSS代码 `<marquee onscroll=alert(1)></marquee> ` ### 漏洞证明： 第二处访问相册的时候会触发 [<img src="https://images.seebug.org/upload/201405/11132140b7e702db483b5e135229364d16bcff5f.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/11132140b7e702db483b5e135229364d16bcff5f.jpg)
