Feasibility Analysis of Dedecms v5.6 chicken rib Injection

 

DEDECMS is widely used in China, and the code has been noticed by script hackers. As the version is updated, other vulnerabilities are not mentioned, and injection vulnerabilities are indeed fewer and fewer, versions 5.5 and 5.6 have few Injection Vulnerabilities. It is observed that there are two reasons: First, strict code writing or auditing, and second, 80sec's built-in Mysqlids. I still read the dede code when I was in version 5.3. Some time ago, I took the time to "meow" the code of the latest version 5.6final, so I got the title of the publisher, discuss the feasibility of injection (other vulnerabilities may not fall into the scope of discussion ).

1. A possible injection point and possible exploitation methods:

Because I just roughly read the plus and member Code, some direct injection may not be seen :)

The possible points are stored in the member directory. Take edit_fullinfo.php as an example to see the code:

...
If ($ dopost = save ){

$ Membermodel = new membermodel ($ pai_ml-> M_MbType );
$ Postform = $ membermodel-> getForm (true );

// Complete the details here
$ Dede_fields = empty ($ dede_fields )? : Trim ($ dede_fields );
$ Dede_fieldshash = empty ($ de_fieldshash )? : Trim ($ dede_fieldshash );
$ Modid = empty ($ modid )? 0: intval (preg_replace ("/[^ d]/", $ modid ));

If (! Empty ($ dede_fields ))
{
If ($ dede_fieldshash! = Md5 ($ dede_fields. $ pai_cookie_encode ))
{
ShowMsg (incorrect data verification, program return,-1 );
Exit ();
}
}
// Although $ dede_fields can construct and submit by itself, the Code verifies the submitted $ dede_fields, from www.oldjun.com

$ Modelform = $ dsql-> GetOne ("SELECT * FROM dede_member_model WHERE id = $ modid ");
If (! Is_array ($ modelform ))
{
Showmsg (the model form does not exist,-1 );
Exit ();
}

$ Inadd_f =;
// $ Dede_fields can be constructed to trigger the injection, from www.oldjun.com
If (! Empty ($ dede_fields ))
{
$ Fieldarr = explode (;, $ dede_fields );
If (is_array ($ fieldarr ))
{
Foreach ($ fieldarr as $ field)
{
If ($ field =) continue;
$ Fieldinfo = explode (, $ field );
If ($ fieldinfo [1] = textdata)
{
$ {$ Fieldinfo [0]} = FilterSearch (stripslashes ($ {$ fieldinfo [0]});
$ {$ Fieldinfo [0]} = addslashes ($ {$ fieldinfo [0]});
}
Else
{
If (empty ($ {$ fieldinfo [0]}) $ {$ fieldinfo [0]} =;
$ {$ Fieldinfo [0]} = GetFieldValue ($ {$ fieldinfo [0]}, $ fieldinfo [1], 0, add, diy, $ fieldinfo [0]);
}
If ($ fieldinfo [0] = "birthday") $ {$ fieldinfo [0]} = GetDateMk ($ {$ fieldinfo [0]});
$ Inadd_f. = ,. $ fieldinfo [0]. "= ". $ {$ fieldinfo [0]}. ""; // The value cannot be constructed, but the column can be constructed, from www.oldjun.com
}
}
}
$ Inadd_f = preg_replace (/,/, $ inadd_f, 1 );
$ Query = "Update' {$ membermodel-> table} 'set {$ inadd_f} WHERE mid = {$ pai_ml-> M_ID }"; // $ inadd_f can trigger the injection through the $ de_fields structure, from www.oldjun.com
If (! $ Dsql-> ExecuteNoneQuery ($ query ))
{
An error occurred while ShowMsg ("Updating the additional table '{$ membermodel-> table}'. Please contact the administrator! "," Javascript :;");
Exit ();
} Else {
ShowMsg (your details are updated successfully !, Edit_fullinfo.php, 0,5000 );
Exit ();
}
}
From the analysis in the code, we can see that $ dede_fields is used to generate $ inadd_f, and $ inadd_f is directly included in the SQL statement. Therefore, if the verification can be bypassed and $ dede_fields is constructed, the injection can be triggered. Verification statement:
$ Dede_fieldshash! = Md5 ($ dede_fields. $ pai_cookie_encode)
To make $ dede_fieldshash equal to md5 ($ dede_fields. $ pai_cookie_encode), we can master two variables, that is, if we know the value of $ pai_cookie_encode, we can pass the verification. Let's see what $ cookie_encode is? The global variables in config. cache. inc. php are generated during installation to see the generated code:

$ Rnd_cookieEncode = chr (mt_rand (ord (A), ord (Z ))).