cmseasy 存储型XSS一枚(无需登录无视360)

2014-07-24T00:00:00
ID SSV:94070
Type seebug
Reporter Root
Modified 2014-07-24T00:00:00

Description

简要描述:

信pandas出真相!

详细说明:

cmseasy在bbs中回帖处允许非登录用户回帖,但取用户名的时候又是从COOKIE中取的,导致了安全问题: /bbs/ajax.php

<?php require_once 'bbs_public.php'; if(!defined('ROOT')) exit('can\'t access!'); //暂时允许用户未登录评论! //验证用户登陆相关操作 //$admin = new action_admin(); if(isset($_POST['reply'])){ if(!isset($_POST['verify']) || strtolower(trim($_POST['verify'])) != strtolower($_SESSION['verify'])){ echo -1; //输入-1表示验证码输入错误! //exit(); } $data = array(); $_POST['content'] = unescape($_POST['content']); $_POST['content'] = xss_clean($_POST['content']); $data['aid'] = isset($_POST['aid']) ? intval($_POST['aid']) : exit(0); $data['tid'] = isset($_POST['tid']) ? intval($_POST['tid']) : 0; $data['content'] = isset($_POST['content']) ? $_POST['content'] : exit(0); $data['username'] = isset($_COOKIE['username']) ? $_COOKIE['username'] : ''; //$data['userid'] = $admin->userid; $data['addtime'] = mktime(); $data['ip'] = $_SERVER['REMOTE_ADDR']; $reply = db_bbs_reply::getInstance(); $r = $reply->inserData($data);

这是回复处的代码。 可见$data['username'] = isset($_COOKIE['username']) ? $_COOKIE['username'] : ''; cmseasy在bbs_public.php以及xss.php中对$_GET、$_POST的XSS做了严格的过滤,但没有处理$_COOKIE变量,所以这里直接取了$_COOKIE['username']作为用户名,导致存储型XSS。 至于360,它是没对cookie中的xss做处理的,只过滤了注入。

漏洞证明:

未登录的情况下,bbs处回复一篇帖子,中途抓包:

<img src="https://images.seebug.org/upload/201407/24161540af301c0bdfeba240873f3454710a6799.jpg" alt="006.jpg" width="600" onerror="javascript:errimg(this);">

如上图,将cookie的username字段改成xss语句 访问帖子即可中招:

<img src="https://images.seebug.org/upload/201407/24161702b35abe51e007d51aeb6199c925f44b09.jpg" alt="007.jpg" width="600" onerror="javascript:errimg(this);">