### 简要描述： cmseay存储型xss 下载的版本为CmsEasy_5.5_UTF-8_20130910 ### 详细说明： bbs/add-archive.php ``` <?php require_once 'bbs_public.php'; //验证用户登陆相关操作,所以测试前需要注册一个用户 $admin = new action_admin(); $admin->check_login(); //验证用户登录 ......省略........ if(isset($_POST['submit'])){ if(strtolower(trim($_POST['verify'])) != strtolower($_SESSION['verify'])){ //确认验证码 action_public::turnPage('index.php','验证码输入错误！'); } $archive = db_bbs_archive::getInstance(); unset($_POST['submit']); unset($_POST['verify']); $_POST['username'] = $_COOKIE['login_username']; //验证用户登录 $_POST['userid'] = $admin->userid; $_POST['ip'] = $_SERVER['REMOTE_ADDR']; $_POST['addtime'] = mktime(); if($id = $archive->inserData($_POST)){ //问题在这里，title没有未过滤 action_public::turnPage('archive-display.php?aid='.$id,'文章添加成功'); }else{ action_public::turnPage('index.php','添加失败，请联系我们！'); } } ``` 跟进路径inserData()->insert()->getInsertString()函数 ``` public function inserData($data){ $r = $this->odb->insert($this->tblName,$data); // if($r) return...
### 简要描述： cmseay存储型xss 下载的版本为CmsEasy_5.5_UTF-8_20130910 ### 详细说明： bbs/add-archive.php ``` <?php require_once 'bbs_public.php'; //验证用户登陆相关操作,所以测试前需要注册一个用户 $admin = new action_admin(); $admin->check_login(); //验证用户登录 ......省略........ if(isset($_POST['submit'])){ if(strtolower(trim($_POST['verify'])) != strtolower($_SESSION['verify'])){ //确认验证码 action_public::turnPage('index.php','验证码输入错误！'); } $archive = db_bbs_archive::getInstance(); unset($_POST['submit']); unset($_POST['verify']); $_POST['username'] = $_COOKIE['login_username']; //验证用户登录 $_POST['userid'] = $admin->userid; $_POST['ip'] = $_SERVER['REMOTE_ADDR']; $_POST['addtime'] = mktime(); if($id = $archive->inserData($_POST)){ //问题在这里，title没有未过滤 action_public::turnPage('archive-display.php?aid='.$id,'文章添加成功'); }else{ action_public::turnPage('index.php','添加失败，请联系我们！'); } } ``` 跟进路径inserData()->insert()->getInsertString()函数 ``` public function inserData($data){ $r = $this->odb->insert($this->tblName,$data); // if($r) return $this->odb->getInsertId(); else return false; } 跟进insert public function insert($table, $data) { $sql = $this->getInsertString($table, $data); return $this->execSql($sql); } 跟进getInsertString public function getInsertString($table, $data) { $n_str = ''; $v_str = ''; $table = $this->filterString($table); foreach ($data as $k => $v) { $n_str .= $this->filterString($k).','; //此处进行过滤 $v_str .= "'".$this->filterString($v)."',"; } $n_str = preg_replace( "/,$/", "", $n_str ); $v_str = preg_replace( "/,$/", "", $v_str ); $str = 'INSERT INTO '.$table.' ('.$n_str.') VALUES('.$v_str.')'; return $str; } ``` 分析filterString()函数 ``` public function filterString($str) { if ($this->magic_quotes) { $str = stripslashes($str); } if ( is_numeric($str) ) { return $str; } else { $ret = @mysqli_real_escape_string($this->con, $str); if ( strlen($str) && !isset($ret) ) { $r = $this->checkConnection(); if ($r !== true) { $this->closeDB(); $ret = $str; } } return $ret; } ``` 应用mysqli_real_escape_string过滤'"进行了过滤,不完整 发表文章查看数据： [<img src="https://images.seebug.org/upload/201309/281248331585a87e4675373cb76fad9a57c333d4.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201309/281248331585a87e4675373cb76fad9a57c333d4.png) [<img src="https://images.seebug.org/upload/201309/28124931ab2b2b272c8129202d6c5ca78c1d6782.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201309/28124931ab2b2b272c8129202d6c5ca78c1d6782.png) 分析再看一下bbs/index.php输出 ``` <?php foreach ($category_data as $v) { $archive_arr = $archive->getDataLimit('aid,cid,lid,title,username,replynum,click,addtime',"cid='{$v['cid']}' AND isstop='0' order by aid desc limit 10 "); ?> 跟进getDataLimit public function getDataLimit($field = '*',$where = '1'){ $sql = "SELECT {$field} FROM {$this->tblName} WHERE {$where}";//构成sql语句 $data = $this->odb->getRows($sql);//跟进瞧了一眼没有过滤 return $data;//输出数据 } ``` ### 漏洞证明： [<img src="https://images.seebug.org/upload/201309/281252053d7dd883add1482397f37b92fc3dd38b.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201309/281252053d7dd883add1482397f37b92fc3dd38b.png)
