网站地图    收藏   

主页 > 入门引导 > 黑客攻防 >

YouYaX论坛前台任意账户登入及修复 - 网站安全

来源:自学PHP网    时间:2015-04-15 15:00 作者: 阅读:

[导读] ext mobile login php 登入页面的处理如下if (isset($_POST[ 39;sub 39;])) { include( 39; ext_public database_mobile php 39;); mysql_query(SET NAMES 39;utf8 39;);...

/ext/mobile/login.php 登入页面的处理如下
 
if (isset($_POST['sub'])) {

    include('../../ext_public/database_mobile.php');

    mysql_query("SET NAMES 'utf8'");

    $sql    = "select* from " . $config['db_prefix'] . "user where binary user='" . addslashes($_POST['user']) . "'  and binary pass='" . md5(addslashes($_POST['pass'])) . "' and status=1 and complete=0";

    $user   = $_POST['user'];

    $result = mysql_query($sql);

    $num    = mysql_num_rows($result);

    if ($num == 1) {

        $_SESSION['youyax_data'] = 1;

        $_SESSION['youyax_user'] = $user;

        $_SESSION['youyax_bz']   = 1;

        @setcookie('youyax_data',1,time()+(60*60*24*30),"/");

        @setcookie('youyax_user',$user,time()+(60*60*24*30),"/");

        @setcookie('youyax_bz',1,time()+(60*60*24*30),"/");

        echo '<script>window.location.href="'.$config['SITE'].'";</script>';

        exit;

    } else {

        $_SESSION['youyax_data'] = 0;

        echo '<script>alert("输入错误 or 尚未激活");</script>';

    }

}

 

 
账号密码正确即赋予 session youyax_data=1 youyax_user=user youyax_bz=1
 
然而,这个session是可以自己构造的。看到/Lib/IndexAction.php 的代码
 
public function index()

    {

        header("Content-Type:text/html; charset=utf-8");

        if (empty($_SESSION['youyax_user']) && !stristr($_SERVER['HTTP_USER_AGENT'], 'android') && !stristr($_SERVER['HTTP_USER_AGENT'], 'iphone') && !stristr($_SERVER['HTTP_USER_AGENT'], 'ipad')) {

            $cache = new Cache(20);

        }

        if(isset($_COOKIE['youyax_data']) && isset($_COOKIE['youyax_user']) && isset($_COOKIE['youyax_bz'])){

         $_SESSION['youyax_data'] = $_COOKIE['youyax_data'];

         $_SESSION['youyax_user'] = $_COOKIE['youyax_user'];

         $_SESSION['youyax_bz'] = $_COOKIE['youyax_bz'];

    }

        if ($_SESSION['youyax_data'] == 1) {

            $bz   = $_SESSION['youyax_bz'];

            $user = $_SESSION['youyax_user'];

            if ($bz != 1)

                $bz = 0;

            if ($bz == 0) {

                $_SESSION['youyax_user'] = "";

                $user                    = "";

                $_SESSION['youyax_data'] = 0;

            }

        } else {

            $_SESSION['youyax_user'] = "";

            $_SESSION['youyax_bz']   = "";

            $bz                      = 0;

            $user                    = "";

        }

        $this->assign('bz', $bz)->assign('user', $user);

 

 
 
显而易见了。检测cookie再将cookie值赋予session。 那么session将变得毫无意义。。
 
构造 Cookie: youyax_data=1; youyax_user=username; youyax_bz=1
 
可前台登入任意用户。对于 一个bbs的话 ,该漏洞是致命的。
 
修复方案:
去掉不必要的

自学PHP网专注网站建设学习,PHP程序学习,平面设计学习,以及操作系统学习

京ICP备14009008号-1@版权所有www.zixuephp.com

网站声明:本站所有视频,教程都由网友上传,站长收集和分享给大家学习使用,如由牵扯版权问题请联系站长邮箱904561283@qq.com

添加评论