Phpwind 7/8 Remote Code Execution Vulnerability and repair

Release date: 2010-09.05
Author: Jie Shi
Affected Version: phpwind 7/8.
Official Address: www.phpwind.net
Vulnerability Type: SQL Injection

Vulnerability Description: A severe vulnerability exists in phpwind forums of higher versions. Successful exploitation of this vulnerability can remotely execute any php code, affecting phpwind 7 and phpwind 8.

Detailed description:
In pw_ajax.php

} Elseif ($ action = pcdelimg ){

InitGP (array (fieldname, pctype ));

InitGP (array (tid, id), 2 );

If (! $ Tid |! $ Id |! $ Fieldname |! $ Pctype ){

Echo fail;

}

$ Id = (int) $ id;

If ($ pctype = topic ){

$ Tablename = GetTopcitable ($ id );

} Elseif ($ pctype = postcate ){

$ Tablename = GetPcatetable ($ id );

}

$ Path = $ db-> get_value ("SELECT $ fieldname FROM $ tablename WHERE tid =". pwEscape ($ tid ));

Fieldname does not have any effective filtering (some of the other global funny looks good filtering does not have any security significance here, but it only brings some difficulty to exploit the vulnerability ), this injection can be used to obtain data from any database.

In addition, class_other.php has the arbitrary command execution vulnerability.

Function threadscateGory ($ classdb) {// generates a post exchange category

$ Classcache = "<? Php $ info_class = array (";

Foreach ($ classdb as $ key => $ class ){

! $ Class [ifshow] & $ class [ifshow] = 0;

$ Flag & $ info_class [$ class [cid] [ifshow] & $ class [ifshow] = 1;

$ Class [name] = str_replace (array ("," "), array (" & quot; "," & #39; "), $ class [name]);

$ Classcache. = "$ class [cid] =>". pw_var_export ($ class ).",";

}

$ Classcache. = ");?> ";

Writeover (D_P. "data/bbscache/info_class.php", $ classcache );

}

$ Class [cid] requires some key to enter this logic without filtering. The key can be obtained through the above injection vulnerability.

 

Solution:

Filter keywords and follow official updates

Supplement: Official just released patch, please promptly update: html "> http://www.phpwind.net/read-htm-tid-1081824.html