qibocms/hr/listperson.php File arbitrarily Include vul Via Variable uninitialization & Getshell

Catalog

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

Relevant Link:
2. Vulnerability Trigger Condition

1 . Find the foreground file Upload point http: // localhost/qibo/hy/choose_pic.php 2 after uploading, directly include the file http: // localhost/qibo/hr/listperson.php? fidtpl[list]=. /upload_files/homepage/pic/0/xxxx/xxx.jpg3. Getshell

3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/hr/listperson.php

//Get label Content//Note that the $FIDTPL here is not initialized, causing the hacker to override the value of this variable through Qibo's "simulated GPC registration mechanism" .$template _FILE=GETTPL ("List_$fiddb[mid]", $FIDTPL ['List']); Fetch_label_value (Array ('PageType'='4','file'= = $template _file,'Module'= = $WEBDB ['module_id']));..//include fileRequire ($template _file);

Continue to follow $TEMPLATE_FILE=GETTPL ("List_$fiddb[mid]", $FidTpl [' list '];

function Gettpl ($html, $tplpath ="'){     Global$STYLE; //$tplpath is our external incoming, the hacker can be controlled by the variable overlay    if($tplpath &&file_exists ($tplpath)) {         //If the file exists, then return directly        return$tplpath; } elseif ($tplpath&&file_exists (Mpath. $tplpath)) {         returnMpath. $tplpath; } elseif (File_exists (Mpath."template/$STYLE/$html. htm"))    {         returnMpath."template/$STYLE/$html. htm"; }    Else    {         returnMpath."template/default/$html. htm"; } }

Back to/hr/listperson.php's require ($template _file), return immediately after the file is included, the program does not have a file path with the inclusion of any validation, restrictions, resulting in any format can directly contain arbitrary content of the file
Relevant Link:

http://www.wooyun.org/bugs/wooyun-2014-081470

5. Defense Methods

/hr/listperson.php

/* */if(!empty ($FIDTPL ['List']) {unset ($FIDTPL ['List']);} /**/$template _file=GETTPL ("List_$fiddb[mid]", $FIDTPL ['List']); Fetch_label_value (Array ('PageType'='4','file'= = $template _file,'Module'= = $WEBDB ['module_id']));

6. Defensive Thinking

Copyright (c) Little5ann All rights reserved

qibocms/hr/listperson.php File arbitrarily Include vul Via Variable uninitialization & Getshell