DedeCMSV53 arbitrary variable Overwrite Vulnerability

Today, I saw an article about mr_xhming.

DedeCMSV53 arbitrary variable Overwrite Vulnerability

BY flyh4t
Http://www.wolvez.org
2008-12-12

DedeCMSV53 is released, but the variable overwrite vulnerability is not completely fixed. This vulnerability is similar to the ryat one :)
Check the code in the Core File include/common. inc. php.

PHP code
// Check and register external submitted Variables
Foreach ($ _ REQUEST as $ _ k => $ _ v)
{
If (strlen ($ _ k)> 0 & eregi (^ (_ | cfg _ | GLOBALS), $ _ k )&&! Isset ($ _ COOKIE [$ _ k]) // is the programmer's logic confused?
{
Exit (Request var not allow !);
}
}

In this case, you can use the submit _ COOKIE variable to bypass the filtering of cfg _ and other keywords.
The next step is to register the variable code

PHP code
Foreach (Array (_ GET, _ POST, _ COOKIE) as $ _ request)
{
Foreach ($ _ request as $ _ k = >$ _ v) $ {$ _ k} = _ RunMagicQuotes ($ _ v );
}

Then initialize the variable

 

// Database Configuration File
Require_once (DEDEDATA./common. inc. php );

// System configuration parameters
Require_once (DEDEDATA. "/config. cache. inc. php"); it seems that it cannot be used, but fortunately there is such a piece of code at the end of the file

// Convert the variables related to the uploaded files and perform security processing, and reference the common upload functions at the front end.
If ($ _ FILES)
{
Require_once (DEDEINC./uploadsafe. inc. php );
} Let's see What uploadsafe. inc. php provides for us.

PHP code
$ Keyarr = array (name, type, tmp_name, size );

Foreach ($ _ FILES as $ _ key = >$ _ value)
{
Foreach ($ keyarr as $ k)
{
If (! Isset ($ _ FILES [$ _ key] [$ k])
{
Exit (Request Error !);
}
}
$ _ Key = $ _ FILES [$ _ key] [tmp_name] = str_replace ("\\","\", $ _ FILES [$ _ key] [tmp_name]);
// Note that through the common. inc. php vulnerability, we can control $ _ FILES [$ _ key] [tmp_name ].
Here, by submitting common. inc. php? _ FILES [pai_xxxx] [tmp_name] = aaaaaa &...... To overwrite ipv_xxxx
Pay attention to assigning values to cookies when using them, and bypass some judgments in uploadsafe. inc. php.