PHPCMS 2008 the latest leak demo test detailed

Phpcms2008 is a web-based content management system based on Php+mysql architecture, and also an open source PHP development platform. PHPCMS Modular approach to development, Easy-to-use features easy to expand, for large and medium-sized sites to provide heavy Web site building solutions. Over the past 3 years, with the PHPCMS team accumulated rich Web development and database experience and the courage to innovate the pursuit of the perfect design concept, so that Phpcms received nearly 100,000 of the site's recognition, and more and more to be applied to large and medium-sized commercial websites.

0x02 wrote it in front.
Phpcms 2008 This is the second time I read the code, has found some problems, but did not release, this time a little careful look, and found some problems
This time put 2, which what the Getshell temporarily will not put, compared to V9, 2008 of the security can really poor, modularity and the degree of code rigor is not v9 strong
This time has not read the code, only to see a few pages, first put 2 of the problems of the place, if there is a better way, then together to discuss

0x03 path???
In include/common.inc.php, this is PHPCMS's global configuration file to load

$dbclass  =  ' db_ '. Db_database; require  $dbclass. ' Class.php ';             $db  = new  $dbclass; $db->connect (Db_host, db_user, db_pw, db_name, db_pconnect, db_charset);             require  ' Session_ '. Session_storage. '. Class.php '; $session  = new session (); Session_set_cookie_params (0, cookie_path, cookie_domain);             if ($_request) {    if ( MAGIC_QUOTES_GPC)     {        $_request =  new_stripslashes ($_request);         if ($_cookie)  $_cookie = new_stripslashes ($_ Cookies);         extract ($db->escape ($_request),  EXTR_SKIP);     }     else     {        $_post  =  $db->escape ($_post);         $_GET =  $db->escape ($_get);         $_COOKIE =  $db->escape ($_cookie);          @extract ($_POST,EXTR_SKIP);          @extract ($_GET,EXTR_SKIP);          @extract ($_COOKIE,EXTR_SKIP);    &NBSP}     if (!defined (' in_admin '))  $_request = filter_ XSS ($_request, allowed_htmltags);     if ($_cookie)   $db->escape ($_cookie); }//echo query_string; if (Query_string && strpos (query_string,  ' = ')  === false &&  Preg_match ("/^ (. *)." ( htm|html|shtm|shtml) $/", query_string,  $urlvar)") {&nbsP;   //var_dump ($urlvar [1]);     //echo  ' test ';     parse_str (Str_replace ('/',  '-',  '   '),  array (' & ',  ' = ',  '),  $urlvar [1]));                }

Here the words first instantiate the database and produce a $DB resource handle that is used to manipulate the database
And then we're going to quantify the parameters that we're passing in.
Here are some small filters that you can look at, so the arguments passed in here as variables
But what about the next line?

if (query_string && strpos (query_string, ' = ') = = False && Preg_match ("/^ (. *)." ( htm|html|shtm|shtml) $/", Query_string, $urlvar)" { //var_dump ($urlvar [1]); echo ' Test '; Parse_str (Str_replace ('/', '-', '), Array (' & ', ' = ', '), $urlvar [1])); }

Look at this?
The query_string here comes from the front.

Define (' Http_referer ', isset ($_server[' http_referer ') "$_server[' Http_referer ']:"); Define (' Script_name ', isset ($_server[' script_name ')] $_server[' script_name ': Preg_replace ("/(. *). PHP (. *)/I", " \1.php ", $_server[' php_self ')); Define (' Query_string ', safe_replace ($_server[' query_string '));

Here's a filter, but it doesn't affect
What if we were to overwrite this db variable here?
Because here Parse_str (Array ('/', '-', ', '), Array (' & ', ' = ', '), $urlvar [1]));
To replace us in the
So if we submit the following characters

Http://localhost/phpcms/index.php?db-5/gid-xd.html

He's going to go wrong because of the db being overwritten, so the physical path explodes.

0X04 SQL INJECTION!!!
In the c.php

$db->query ("UPDATE"). Db_pre. " Ads SET ' clicks ' =clicks+1 WHERE adsid= '. $ads [' Adsid ']); $info [' username '] = $_username; $info [' clicktime '] = time (); $info [' IP '] = IP; $info [' adsid '] = $id; $info [' referer '] = http_referer; $year = Date (' ym ', time); $table = db_pre. ' Ads_ '. $year; $table _status = $db->table_status ($table); echo ' Test '; if (! $table _status) { include mod_root. ' include/create.table.php '; } $db->insert ($table, $info);

Notice here the Http_referer this constant
The constants here are defined by the previous common.inc.php.
Define (' Http_referer ', isset ($_server[' http_referer ') "$_server[' Http_referer ']:");
No filtering operation, so you know, I guess a lot of students have found, but did not publish, so I xxoo for you, haha ... Don't scold me.
And then
$db->insert ($table, $info);
Let's take a look at its operation here.

function Insert ($tablename, $array) { $this->check_fields ($tablename, $array); return $this->query ("INSERT into '$tablename '". Implode (', ', Array_keys ($array)). " ". Implode (" ', ' ", $array)."); echo "INSERT into ' $tablename ' ('". Implode (', ', Array_keys ($array)). " ' ". Implode (" ', ' ", $array)."]

So you know.