Phpwind 7.5 Multiple Include Vulnerabilities

Edit Note: The page width is insufficient. If you want to view details in this article, please copy all the selected content to your computer notepad or Word document,

The full text is displayed.

Phpwind 7.5 Multiple Include Vulnerabilities author: 80 vulteam: http://www.80vul.com I. api/class_base.php local vulnerability 1. the $ mode variable in the callback function in the api/class_base.php file is not filtered, causing arbitrary inclusion of local files, allowing you to execute arbitrary PHP commands. 2. specific analysis api/class_base.php file: function callback ($ mode, $ method, $ params) {if (! Isset ($ this-> classdb [$ mode]) {if (! File_exists (R_P.api/class _. $ mode .. php) {return new ErrorMsg (API_MODE_NOT_EXISTS, "Class ($ mode) Not Exists");} require_once (R_P.api/class _. $ mode .. php); // here $ this-> classdb [$ mode] = new $ mode ($ this);} if (! Method_exists ($ this-> classdb [$ mode], $ method) {return new ErrorMsg (API_METHOD_NOT_EXISTS, "Method ($ method of $ mode) Not Exists ");}! Is_array ($ params) & $ params = array (); return @ call_user_func_array (array (& $ this-> classdb [$ mode], $ method), $ params );} let's continue with the process of passing specific variables. the above functions are called in run (): function run ($ request) {$ request = $ this-> strips ($ request ); if (isset ($ request [type]) & $ request [type] = uc) {$ this-> type = uc; $ this-> apikey = $ GLOBALS [uc_key]; // note that this variable is also the key to this vulnerability} else {$ this-> type = app; $ this-> apikey = $ GLOBALS [db_siteownerid]; $ this-> Siteappkey = $ GLOBALS [db_siteappkey];}/*** if ($ this-> type = app &&! $ GLOBALS [o_appifopen]) {return new ErrorMsg (API_CLOSED, App Closed);} ***/ksort ($ request); reset ($ request); $ arg =; foreach ($ request as $ key =>$ value) {if ($ value & $ key! = Sig) {$ arg. = "$ key = $ value &" ;}} if (md5 ($ arg. $ this-> apikey )! = $ Request [sig]) {// pay attention to this judgment and bypass it. the above Code shows that $ this-> apikey = $ GLOBALS [uc_key], and $ request [sig] can be controlled, so it is easy to bypass it return new ErrorMsg (API_SIGN_ERROR, Error Sign);} $ mode = $ request [mode]; // get $ mode without filtering and directly enter the following callback () $ method = $ request [method]; $ params = isset ($ request [params])? Unserialize ($ request [params]): array (); if (isset ($ params [appthreads]) {if (PHP_VERSION <5.2) {require_once (R_P.api/class_json.php ); $ json = new Services_JSON (true); $ params [appthreads] = $ json-> decode (@ gzuncompress ($ params [appthreads]);} else {$ params [appthreads] = json_decode (@ gzuncompress ($ params [appthreads]), true) ;}} if ($ params & isset ($ request [charset]) {$ params = pwConvert ($ params, $ this-> charset, $ request [charset]);} return $ this-> callback ($ mode, $ method, $ params ); // call callback ()} Let's continue to look at the call of the run () function: In the pw_api.php file: $ api = new api_client (); $ response = $ api-> run ($ _ POST + $ _ GET); // directly run the variable submitted by $ _ POST and $ _ GET. the above analysis is a retrograde analysis of the entire vulnerability variable submission process. In fact, this vulnerability also contains a encoding and decoding question: require_once (R_P.api/class _. $ mode .. php); this requires bypassing magic quotes to include easy files. pay attention to the first sentence of run () $ request = $ this-> strips ($ request); strips () code: function strips ($ param) {if (is_array ($ param) {foreach ($ param as $ key => $ value) {$ param [$ key] = $ this-> strips ($ value) ;}} else {$ param = stripslashes ($ param); // The variable uses stripslashes directly, so we can directly bypass the magic quotes :)} return $ param;} 3.POC/ EXP missing 4. FIX the vulnerability information leakage, which has been officially fixed: http://www.phpwind.net/read-htm-tid-914851.html Code: require_once Pcv (R_P.api/class _. $ mode .. php); function Pcv ($ filename, $ ifcheck = 1) {$ tmpname = strtolower ($ filename); $ tmparray = array (http ://,""); // filter http: // it means that the remote access is not allowed to block $ ifcheck & $ tmparray [] = ..; // filtered .. this means that the Skip directory is not allowed if (str_replace ($ tmparray, $ tmpname )! = $ Tmpname) {exit (Forbidden);} return $ filename;} from Pcv (), we can see that the phpwind patch style is very cumbersome, there are still many logic problems from this pcv alone. For example, http: // is a funny filter, so people cannot use ftp ://?... II. apps/share/index. php Remote Inclusion Vulnerability 1. describe apps/share/index. in php, $ route and $ basePath variables are not initialized. As a result, php files are remotely included or local files are contained, and arbitrary php code is executed. 2. specific analysis <? Phpif ($ route = "share") {require_once $ basePath. /action/m_pai.php;} elseif ($ route = "sharelink") {require_once $ basePath. /action/m_sharelink.php;}?> This vulnerability does not seem to need to be analyzed !!!! I suggest that the person who writes this code deduct the year-end bonus... 3.POC/ EXP missing 4. The FIX has been fixed at the same time as the patch. http://www.phpwind.net/read-htm-tid-914851.html <? Php! Function_exists (readover) & exit (Forbidden); if ($ route = "share") {require_once $ basePath. /action/m_pai.php;} elseif ($ route = "sharelink") {require_once $ basePath. /action/m_sharelink.php;}?> III. apps/groups/index. php Remote Inclusion Vulnerability 1. describe apps/groups/index. in php, $ route and $ basePath variables are not initialized. As a result, php files are remotely included or local files are contained, and arbitrary php code is executed. 2. specific analysis <? Phpif ($ route = "groups") {require_once $ basePath. /action/m_groups.php;} elseif ($ route = "group") {require_once $ basePath. /action/m_group.php;} elseif ($ route = "galbum") {require_once $ basePath. /action/m_galbum.php;} the vulnerability does not seem to need to be analyzed !!!! I suggest that the person who writes this code deduct the year-end bonus... 3.POC/ EXP missing 4. The FIX has been fixed at the same time as the patch. http://www.phpwind.net/read-htm-tid-914851.html <? Php! Function_exists (readover) & exit (Forbidden); if ($ route = "groups") {require_once $ basePath. /action/m_groups.php;} elseif ($ route = "group") {require_once $ basePath. /action/m_group.php;} elseif ($ route = "galbum") {require_once $ basePath. /action/m_galbum.php;}?>