Multiple Vulnerabilities in okphp products

Author: SuperHei article Nature: original release date: the program described OKPHP is developed by www.okphp.com a professional website management system, the current products include: OkphpCMS, OkphpBBS, OkphpBLOG. Due to the instrict filtering of variables and lax password authentication, SQL injection, xss, and hidden variable post attacks are performed from cross-permission operations. Author: SuperHei
Nature of the article: Original
Release date:

Program Description

OKPHP is a professional website management system developed by www.okphp.com. its current products include Okphp CMS, Okphp BBS, and Okphp BLOG. Due to the instrict filtering of variables and lax password authentication, SQL injection, xss, and hidden variable post attacks are performed from cross-permission operations.

Vulnerability attack

1. SQL injection and xss

"Almost" exists in various variables, such as forum. php.

Http://www.xxx.com/forum.php? Action = view_forum & forum_id = {SQL}
Http://cn.okphp.com/forum.php? Action = view_forum & forum_id = 'xss
.......

2. hidden variable post attack

When submitting request. php? Action = user_modify when modifying user data, without password authentication, it is easy to modify user passwords and data through user_id;

Exp:

Okphp Discussions-powered by okphp BBS

Solution

1. Enhanced Variable filtering
2. Add password authentication