Authentication mechanism must be added for full-site source code leakage in the Shui Mu community (indirect secondary code audit is allowed)

Authentication mechanism must be added for full-site source code leakage in the Shui Mu community (indirect secondary code audit is allowed)

Full-site source code leakage in the Shui Mu community (indirect secondary code audit can expand the impact)
Design, deployment, and installation documents, user data structures, and database configuration information are all leaked.

#1 Overview

Vulnerability discovery: svn information leaked from shuimu 2station

Vulnerability address: http://bloom.newsmth.net/.svn/entries


 

HTTP/1.1 200 OKcontent-length: 19803via: 1.0 www.2.newsmth.net (squid/3.1.10)x-cache: HIT from www.2.newsmth.netaccept-ranges: bytesserver: nginxlast-modified: Tue, 10 Apr 2012 06:12:27 GMTconnection: keep-aliveetag: "4f83cf4b-4d5b"date: Fri, 11 Mar 2016 05:00:33 GMTcontent-type: application/octet-streamx-cache-lookup: HIT from www.2.newsmth.net:800010dir11132http://svn.kcn.cn/repos/kbs/trunk/www2http://svn.kcn.cn/repos/kbs2012-03-22T12:51:01.977509Z11109jiangjun

 

#2 the result is a SVN server without access control.
 

 

#3 the source code of the Shui Mu community is all here
 

http://svn.kcn.cn/repos/kbssvn co http://svn.kcn.cn/repos/kbs ./kbs

 

/* Database related */define ("DB_ENABLED", true); $ dbuser = "wForum"; $ dbpasswd = "fuckatp"; $ dbname = "wForum "; /* Other additional functions */define ("SHOWTELNETPARAM", false); define ("ALLOW_SYSOP_MULTIQUERY", true); define ('Allow _ self_multiquery', true ); define ("SUPPORT_TEX", true); define ("ONBOARD_USERS", true );

 

if (!defined('_BBS_WWW2_BOARD_PHP_')){define('_BBS_WWW2_BOARD_PHP_', 1);function bbs_boards_navigation_bar(){?>

[Homepage Introduction]
[Classification discussion area]
[New discussion board]
[Recommendation Forum]
[Ranking of Forum popularity]
[Excellent public layout]
[Quick Return]

 

}

Function undo_html_format ($ str)
{
$ Str = preg_replace ("/& apos;/I", "'", $ str );
$ Str = preg_replace ("/>/I", ">", $ str );
$ Str = preg_replace ("/</I", "<", $ str );
$ Str = preg_replace ("/"/I "," \ "", $ str );
$ Str = preg_replace ("/&/I", "&", $ str );
Return $ str;
}

If (version_compare (PHP_VERSION, '5', '> = '))
Require_once ('domxml-php4-to-php5.inc.php '); // Load the PHP5 converter

# Iterate through an array of nodes
# Looking for a text node
# Return its content
Function get_content ($ parent)
{
$ Nodes = $ parent-> child_nodes ();
While ($ node = array_shift ($ nodes ))
If ($ node-> node_type () = XML_TEXT_NODE)
Return $ node-> node_value ();
Return "";
}

# Get the content of a participant node
Function find_content ($ parent, $ name)
{
$ Nodes = $ parent-> child_nodes ();
While ($ node = array_shift ($ nodes ))
If ($ node-> node_name () = $ name)
Return undo_html_format (urldecode (get_content ($ node )));
Return "";
}

User Data Structure
 

CREATE TABLE IF NOT EXISTS `board_user` (  `board` varchar(32) COLLATE gbk_bin NOT NULL,  `user` varchar(32) COLLATE gbk_bin NOT NULL,  `time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,  `status` int(11) NOT NULL,  `manager` varchar(32) COLLATE gbk_bin NOT NULL,  `score` int(11) NOT NULL,  `flag` bigint(20) NOT NULL,  UNIQUE KEY `member` (`board`,`user`),  KEY `board` (`board`),  KEY `user` (`user`),  KEY `time` (`time`),  KEY `flag` (`flag`),  KEY `status` (`status`),  KEY `score` (`score`)) ENGINE=InnoDB DEFAULT CHARSET=gbk COLLATE=gbk_bin;

 

Solution:

# Delete svn of shuimu 2station

# Add svn server to authentication mechanism