dedecms/plus/ad_js.php,/plus/mytag_js.php vul Via injecting php Code by/plus/download.php into DB &&/include/de desql.class.php

Directory

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

For this vulnerability, we can briefly summarize the following

1."/plus/download.php"Files are introduced"/include/common.inc.php"file2."/include/common.inc.php"The variables entered by the user are"variable Local Registration", if the registered variable is not explicitly initialized, it causes the local variable to overwrite3."/include/common.inc.php"Will introduce"/include/dedesql.class.php"file4. A vulnerability exists"/include/dedesql.class.php"，"No"initializes the $arrs1, $arrs 2 arrays, causing the hacker to overwrite the 2 variables with an external input5. Hackers through to"/plus/download.php"The file is post into a specially constructed packet, by overwriting the two arrays of $arrs1, $arrs 2, eventually polluting"data Table prefix variable $cfg_"This one"data Table prefix variable $cfg_"will be brought into the SQL query statement of the database, resulting in SQL injection6."/plus/ad_js.php"、"/plus/mytag_js.php"The PHP code that was injected from the database is queried, written to the write cache file, and included to execute, resulting in code execution

Relevant Link:

http://bbs.safedog.cn/thread-52264-1-1.htmlhttp://www.2cto.com/Article/ 201205/129974.htmlhttp://www.91ri.org/6462.htmlhttp://phpinfo.me/ 2013/12/24/111.html

2. Vulnerability Trigger Condition

1 " /include/dedesql.class.php "," no " for $arrs1, $arrs 2 The two arrays are initialized 2"/plus/ad_ js.php","/plus/mytag_js.php" does not effectively filter and detect data queried from the database

0x1: Manual Validation

Http://localhost/dedecms5.7/plus/ad_js.php?aid=21

3. Vulnerability Impact Range

1. Dedecms v5. 7 2. <= Dedecms v5. 7

4. Vulnerability Code Analysis
5. Defense Methods

0x1: /include/dedesql.class.php

/* */$arrs 1=Array (); $arrs 2=Array ();//Special Operationsif(Isset ($GLOBALS ['arrs1']) {$v 1= $v 2 ="';  for($i =0; Isset ($arrs 1[$i]); $i + +) {$v 1.=chr ($arrs 1[$i]); }     for($i =0; Isset ($arrs 2[$i]); $i + +) {$v 2.=chr ($arrs 2[$i]); } $GLOBALS [$v 1].=$v 2;}/* */

0x2:/plus/ad_js.php

.. function Find_ad_payload ($adbody, $aid) {Global$db; $express="/<\? (PHP) {0,1} (. *)/ I"; if(Preg_match ($express, $adbody)) {$sql="DELETE from ' #@__myad ' WHERE aid= ' $aid '"; $rs= $dbexecutenonequery ($sql); if(File_exists (Dededata.'/cache/myad-'. $aid.'. htm') {@unlink (dededata).'/cache/myad-'. $aid.'. htm'); } die ("Request error!"); }  }if(Isset ($arcID)) $aid =$arcID; $arcID= $aid = (isset ($aid) && is_numeric ($aid))? $aid:0;if($aid = =0) Die ('Request error!'); $cacheFile= Dededata.'/cache/myad-'. $aid.'. htm';if(Isset ($nocache) | |!file_exists ($cacheFile) | | time ()-Filemtime ($cacheFile) >$cfg _puccache_time) {$row= $dsql->getone ("SELECT * from ' #@__myad ' WHERE aid= ' $aid '"); $adbody="'; if($row ['Timeset']==0) {$adbody= $row ['Normbody']; }    Else{$ntime=Time (); if($ntime > $row ['Endtime'] || $ntime < $row ['StartTime']) {$adbody= $row ['Expbody']; } Else{$adbody= $row ['Normbody'];    }} find_ad_payload ($adbody, $aid); ...

0x3:/plus/mytag_js.php

.. function Find_tag_payload ($tagbody, $aid) {Global$db; $express="/<\? (PHP) {0,1} (. *)/ I"; if(Preg_match ($express, $tagbody)) {$sql="DELETE from ' #@__mytag ' WHERE aid= ' $aid '"; $rs= $dbexecutenonequery ($sql); if(File_exists (Dededata.'/cache/mytag-'. $aid.'. htm') {@unlink (dededata).'/cache/mytag-'. $aid.'. htm'); } die ("Request error!"); }  }if(Isset ($arcID)) $aid =$arcID; $arcID= $aid = (isset ($aid) && is_numeric ($aid))? $aid:0;if($aid = =0) Die ("document.write (' Request error! ');"); $cacheFile= Dededata.'/cache/mytag-'. $aid.'. htm';//Die (Var_dump ($cacheFile));if(Isset ($nocache) | |!file_exists ($cacheFile) | | time ()-Filemtime ($cacheFile) >$cfg _puccache_time) {$PV=NewPartview (); $row= $PV->dsql->getone ("SELECT * from ' #@__mytag ' WHERE aid= ' $aid '"); if(!Is_array ($row)) {$myvalues="<!--\r\ndocument.write (' not found input! '); R\n-->"; }    Else{$tagbody="'; if($row ['Timeset']==0) {$tagbody= $row ['Normbody']; }        Else{$ntime=Time (); if($ntime > $row ['Endtime'] || $ntime < $row ['StartTime']) {$tagbody= $row ['Expbody']; }            Else{$tagbody= $row ['Normbody'];        }} find_tag_payload ($tagbody, $aid); $PV->settemplet ($tagbody,'string'); ...

6. Defensive Thinking

Not currently

Copyright (c) Littlehann All rights reserved

dedecms/plus/ad_js.php,/plus/mytag_js.php vul Via injecting php Code by/plus/download.php into DB &&/include/de desql.class.php