Alibaba Cloud website promotion system v4.02cookie spoofing and repair

 

Brief description: SQL vulnerabilities in the promotion system of the Alibaba Cloud website appear on the Internet. It seems that no one has published the cookie spoofing vulnerability! Axi website promotion system v4.02cookie Spoofing Vulnerability, you know ----

For more information, see the source code of axphp. php.

------------------------------------------------

<Tr>

<Td> account: </td>

<Td> <form method = "post" action = "login. php"> // submit the processing file login. php.

<Input tabindex = "1" type = "text" name = "adminname" class = "texta" onkeyup = "value = value. replace (/[^ \ w \. \/]/ig, '')"/> </td>

<Td rowspan = "2"> <input type = "submit" value = "Logon" class = "submit"/> </td>

</Tr>

<Tr>

<Td> password: </td>

<Td> <input tabindex = "2" type = "password" name = "adminpass" class = "textb"/> </td> </form>

 

Login. php code

-------------------------------------------------

Require '../config. php ';

$ Adminname = $ _ POST ['adminname'];

$ Adminpass = $ _ POST ['adminpass'];

$ Adminpass. = "Axphp.com ";

$ Adminpass = md5 ($ adminpass );

$ Adminsql = "select * from axphp_admin where adminname = '$ adminname' and adminpass =' $ adminpass '";

$ Adminery = mysql_query ($ adminsql, $ config );

$ Adminnum = mysql_num_rows ($ adminery );

If ($ adminnum = "1") {// if the user and password are correct, set the cookie

Setcookie ("admin", "Y", time () + 3600, '/'); // set the cookie value admin = 'y'

Setcookie ("admin_name", $ adminname, time () + 3600, '/'); // set the value of the cookie value admin_name

Header ("location: axadmin. php"); // if the user and password are correct, go to the background management page.

} Else {

Header ("location: axphp. php ");

}

 

Go to the axadmin. php code.

-----------------------------------------------

<? Php

Require 'Check. php'; // cookie verification file.

Require '../template/axadmin/head. php ';

Require '../template/axadmin/banner. php ';

Require '../template/axadmin/main. php ';

Require '../template/axadmin/bottom. php'

?>

Check. php code

-------------------------------------

<? Php

Error_reporting (0 );

Isset ($ _ COOKIE ['admin'])? $ Check = $ _ COOKIE ['admin']: $ check = null;

// We only need to leave the $ _ COOKIE ['admin'] value empty.

Isset ($ _ COOKIE ['admin _ name'])? $ Admin_user = $ _ COOKIE ['admin _ name']: $ user = null;

// The same is true here.

If ($ check = null) {header ("Location: ../index. php"); exit ;}

?>

Proof of vulnerability:

 

 

 

Solution: Add cookie verification in the background

From Group 08: http://www.huc08.com