HdhCmsTest2cto测试数据：致各位转载的同志们，请您在转载时给本站留个链接或者写一个转自本站，多谢多谢。
我们的文章都经过我们的辛勤加工，是有成本在里面的，请您多多支持，让我们能够发展的更好，我们才能做出更多的奉献
标题: POSH <= 3.1.1 Multiple Vulnerabilities
作者: CrashFr
开发者: http://sourceforge.net/projects/posh/
受影响版本: 3.1.1
测试平台: Linux
#
//----- Advisory
Program : POSH 3.1.1 and prior
Vendor : HdhCmsTestportaneo测试数据
Homepage : http://sourceforge.net/projects/posh/
Discovery : 2011/09/19
Author Contacted : 2011/09/20
Found by : CrashFr
This Advisory : CrashFr
//----- 程序说明：
POSH (Portaneo Open Source Homepage) is a personalizable interface (Netvibes, iGoogle) that can be used in a web application or educational / enterprise intranet context. Enterprise version adds social network, notebooks and search feature.
//----- 缺陷分析
Local File Inclusion, Cross-Site Scripting (XSS) and Information Disclosure vulnerabilities were identified within POSH version 3.1.1
--- 信息泄露---
- http://HdhCmsTest2cto测试数据 /posh/portal/login.php?lang=fr-en
- 缺陷在includes/sessions.inc.php 上
Replace:
if ( preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) {
$_SESSION['lang'] = $_GET["lang"];
By:
if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('l10n/'.$_GET["lang"].'/lang.php')) {
$_SESSION['lang'] = $_GET["lang"];
--- XSS ---
- http://HdhCmsTest2cto测试数据 /posh/portal/login.php?message=XSS%20Catched%20!%22%29%29;alert%28%22XSS%22%29;//
- 缺陷在: templates/default/login.php line 42
Replace: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'.$message.'"));</script></font><br /><br />';
By: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'. html specialchars($message).'"));</script></font><br /><br />';
- http://HdhCmsTest2cto测试数据 /posh/admin/login.php?extid=ok%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E
- 缺陷在: templates/default/login_adminsimplified.php line 93
Replace: <input type="hidden" name="extid" maxlength="16" value="<?php echo $extid; ?>" class="thinbox" />
By: <input type="hidden" name="extid" maxlength="16" value="<?php if(is_int($extid)){ echo $extid; } ?>" class="thinbox" />
- http://HdhCmsTest2cto测试数据 /posh/admin/index.php?extid=1%29;alert%28%27XSS%27
- 缺陷在: templates/default/index_adminsimplified.php line 67 and 70
Replace: $p.admin.widgets.loadModExtId(<?php echo $extid; ?>);
By: $p.admin.widgets.loadModExtId(<?php if(is_int($extid)){ echo $extid; } ?>);
Replace: $p.admin.widgets.refreshIcons(icon,<?php echo $extid; ?>);
By: $p.admin.widgets.refreshIcons(icon,<?php if(is_int($extid)){ echo $extid; } ?>);
--- 本地文件包含---
- http://HdhCmsTest2cto测试数据 /posh/portal/scr_changelang.php => POST lang=etc/passwd%00
POST http://HdhCmsTest2cto测试数据 /posh/portal/scr_changelang.php HTTP/1.1
lang=etc/passwd%00
- Call http://HdhCmsTest2cto测试数据 /posh/portal/moduleff.php for example to see the result (a lot of page use __LANG to include lang file)
- 缺陷在portal/scr_changelang.php line 67
Replace: $_SESSION['lang']=$lang;
By: if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('l10n/'.$_GET["lang"].'/lang.php')) {
$_SESSION['lang']=$lang;
}
//-----解决方法：
Apply patchs
Upgrade POSH to 3.1.2
//----- 时间轴
2011-09-20- Reported to vendor
2011-09-21- Vendor Reply
2011-09-25- Vendor released POSH 3.1.2
2011-10-10- Vulnerability Disclosed
//----- Credits
http://HdhCmsTestsysdream测试数据
crashfr at sysdream dot com
//----- Greetings
HZV (http://HdhCmsTesthackerzvoice.net)
查看更多关于POSH多重缺陷及修复 - 网站安全 - 自学php的详细内容...