Duxcms SQL Injection in/admin/module/loginmod.class.php

Directory

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

DUXCMS is a PHP development, based on the HMVC rules to develop suitable for small and medium-sized enterprises, companies, news, personal and other related industries Web site content Management, its background login in the presence of SQL injection, hackers through this vulnerability to obtain administrator password, direct arbitrary user login background and other attacks

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2010-063055

2. Vulnerability Trigger Condition

1 . User name -1"  Union Select, ' c4ca4238a0b923820dcc509a6f75849b ', 5,6,7,8,9,10,11#  /* The MD5 here is the number 1 MD5*/21

3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/admin/module/loginmod.class.php

//Login Detection Publicfunction Check () {if(Empty ($_post['User']) || Empty ($_post['Password']))    {        $ This->msg ('account information input Error!',0); }    //Get account information    /*here is the key to the vulnerability, the program does not correctly filter the user's input, escape*/$info= Model ('Login')->user_info ($_post['User']); //Perform account verification    if(Empty ($info)) {$ This->msg ('Login failed! No this admin account!',0); }    if($info ['Password'] <> MD5 ($_post['Password']))    {        $ This->msg ('Login failed! password Error!',0); }    if($info ['Status']==0)    {        $ This->msg ('Login failed! Account is disabled!',0); }    //Update your account information$data ['Logintime']=Time (); $data ['IP']=get_client_ip (); $data ['Loginnum']=intval ($info ['Loginnum'])+1; Model ('Login')->edit ($data, Intval ($info ['ID'])); //Update login RecordModel'Log'),Login_log ($info); //Setting up login information$_session[$ This->config['SPOT'].'_user']= $info ['ID']; Model ('User')->current_user (false); $ This->msg ('Login Successful!',1); }

5. Defense Methods

/admin/module/loginmod.class.php

//Login Detection Publicfunction Check () {if(Empty ($_post['User']) || Empty ($_post['Password']))    {        $ This->msg ('account information input Error!',0); }    //SQL Injection Defense$_post['User'] = Addslashes ($_post['User']); $_post['Password'] = Addslashes ($_post['Password']); //Get account information    /*here is the key to the vulnerability, the program does not correctly filter the user's input, escape*/$info= Model ('Login')->user_info ($_post['User']); //Perform account verification    if(Empty ($info)) {$ This->msg ('Login failed! No this admin account!',0); }    if($info ['Password'] <> MD5 ($_post['Password']))    {        $ This->msg ('Login failed! password Error!',0); }    if($info ['Status']==0)    {        $ This->msg ('Login failed! Account is disabled!',0); }    //Update your account information$data ['Logintime']=Time (); $data ['IP']=get_client_ip (); $data ['Loginnum']=intval ($info ['Loginnum'])+1; Model ('Login')->edit ($data, Intval ($info ['ID'])); //Update login RecordModel'Log'),Login_log ($info); //Setting up login information$_session[$ This->config['SPOT'].'_user']= $info ['ID']; Model ('User')->current_user (false); $ This->msg ('Login Successful!',1); }

6. Defensive Thinking

Copyright (c) Littlehann All rights reserved

Duxcms SQL Injection in/admin/module/loginmod.class.php