YouYaX论坛前台任意账户登入及修复 - 网站安全

/ext/mobile/login.php 登入页面的处理如下

 

if (isset($_POST['sub'])) { include('ext_public/database_mobile.php'); mysql_query("SET NAMES 'utf8'"); $sql = "select* from " . $config['db_prefix'] . "user where binary user='" . addslashes($_POST['user']) . "' and binary pass='" . md5(addslashes($_POST['pass'])) . "' and status=1 and complete=0"; $user = $_POST['user']; $result = mysql_query($sql); $num = mysql_num_rows($result); if ($num == 1) { $_SESSION['youyax_data'] = 1; $_SESSION['youyax_user'] = $user; $_SESSION['youyax_bz'] = 1; @setcookie('youyax_data',1,time()+(60*60*24*30),"/"); @setcookie('youyax_user',$user,time()+(60*60*24*30),"/"); @setcookie('youyax_bz',1,time()+(60*60*24*30),"/"); echo '<script>window.location.href="'.$config['SITE'].'";</script>'; exit; } else { $_SESSION['youyax_data'] = 0; echo '<script>alert("输入错误 or 尚未激活");</script>'; } }

 

 

 

然而，这个session是可以自己构造的。看到/Lib/IndexAction.php 的代码

 

public function index() { header("Content-Type:text/html; charset=utf-8"); if (empty($_SESSION['youyax_user']) && !stristr($_SERVER['HTTP_USER_AGENT'], 'android') && !stristr($_SERVER['HTTP_USER_AGENT'], 'iphone') && !stristr($_SERVER['HTTP_USER_AGENT'], 'ipad')) { $cache = new Cache(20); } if(isset($_COOKIE['youyax_data']) && isset($_COOKIE['youyax_user']) && isset($_COOKIE['youyax_bz'])){ $_SESSION['youyax_data'] = $_COOKIE['youyax_data']; $_SESSION['youyax_user'] = $_COOKIE['youyax_user']; $_SESSION['youyax_bz'] = $_COOKIE['youyax_bz']; } if ($_SESSION['youyax_data'] == 1) { $bz = $_SESSION['youyax_bz']; $user = $_SESSION['youyax_user']; if ($bz != 1) $bz = 0; if ($bz == 0) { $_SESSION['youyax_user'] = ""; $user = ""; $_SESSION['youyax_data'] = 0; } } else { $_SESSION['youyax_user'] = ""; $_SESSION['youyax_bz'] = ""; $bz = 0; $user = ""; } $this->assign('bz', $bz)->assign('user', $user);

 

 

 

显而易见了。检测cookie再将cookie值赋予session。 那么session将变得毫无意义。。

 

 

可前台登入任意用户。对于 一个bbs的话 ，该 漏洞 是致命的。

 

修复方案：

去掉不必要的

查看更多关于YouYaX论坛前台任意账户登入及修复 - 网站安全的详细内容...