HDWiki 5.1 arbitrary User Password Modification Vulnerability and repair

A logic vulnerability exists in password resetting in HDWiki, which allows attackers to modify arbitrary user passwords.
Detailed description:
Control/user. php
Function dogetpass (){
......
} Elseif (isset ($ this-> post ['verifystring']) {
$ Uid = $ this-> post ['uid'];
$ Encryptstring = $ this-> post ['verifystring'];
$ Idstring = $ _ ENV ['user']-> get_idstring_by_uid ($ uid, $ this-> time );
If ($ idstring = $ encryptstring ){
// A logic error is returned because the submission is empty and the query is returned empty.
$ Newpass = $ this-> post ['Password'];
$ Renewpass = $ this-> post ['repassword'];
$ Error = $ _ ENV ['user']-> checkpassword ($ newpass, $ renewpass );
If ($ error = 'OK '){
// Eval ($ this-> plugin ["ucenter"] ["hooks"] ["getpass"]);
UC_OPEN & $ msg =$ _ ENV ['ucenter']-> getpass ($ uid, $ newpass );
$ _ ENV ['user']-> update_field ('Password', md5 ($ newpass), $ uid );
$ _ ENV ['user']-> update_getpass ($ uid );
$ This-> message ($ this-> view-> lang ['resetpasssucess '], 'index. php? User-login ', 0 );
} Else {
$ This-> message ($ error, 'back', 0 );
}
} Else {
$ This-> message ($ this-> view-> lang ['resetpassmessage'], WIKI_URL, 0 );
}
}
 
Function get_idstring_by_uid ($ uid, $ time) {// obtain the verification code
Return $ this-> db-> result_first ("SELECT code FROM ". DB_TABLEPRE. "activation WHERE uid = $ uid AND available = 1 AND type = 1 AND time> ($ time-3*24*3600) order by time DESC ");
}
Proof of vulnerability: http://www.bkjia.com/index. php? User-getpass-user ID
 
The normal situation should be like this, user-getpass-1-xxx, but because of logic problems, you can go around.
In this case, the verifystring variable in the form is empty. Enter the new password twice and then reset it.
 
In fact, there is an injection here. When you get the verification code...
Solution: For logic problems, consider the case where the detection code is empty and the user's reset record is not in the database.
 
Temporary solution:
} Elseif (isset ($ this-> post ['verifystring']) {
$ Uid = $ this-> post ['uid'];
$ Encryptstring = $ this-> post ['verifystring'];
$ Idstring = $ _ ENV ['user']-> get_idstring_by_uid ($ uid, $ this-> time );
/* Determine the null condition */
If (empty ($ encryptstring) | empty ($ idstring )){
$ This-> message ($ error, 'back', 0 );
}

Author milk Tank