当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2012-04524

漏洞标题：人民网php配置不当导致php源码被下载

相关厂商：人民网

漏洞作者： 小雨

提交时间：2012-02-15 11:50

修复时间：2012-03-31 11:50

公开时间：2012-03-31 11:50

漏洞类型：系统/服务运维配置不当

危害等级：中

自评Rank：5

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2012-02-15： 细节已通知厂商并且等待厂商处理中
2012-02-17： 厂商已经确认，细节仅向厂商公开
2012-02-27： 细节向核心白帽子及相关领域专家公开
2012-03-08： 细节向普通白帽子公开
2012-03-18： 细节向实习白帽子公开
2012-03-31： 细节向公众公开

简要描述：

人民网php配置不当导致php源码被下载

详细说明：

由于服务器禁用了短标签，导致php文件源码被下载。泄漏大量表结构等。。。
http://house.people.com.cn/xinwen/chakanpinlun.php

漏洞证明：

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>评论--<?=$id?></title>
<style type="text/css">
<!--
body {
margin-left: 0px;
margin-top: 0px;
margin-right: 0px;
margin-bottom: 0px;
}
-->
</style>
<link href="../people.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--
.style2 {
font-size: 14px;
color: #FFFFFF;
font-weight: bold;
}
.tt36 {
FONT-WEIGHT: bold; FONT-SIZE: 26px; COLOR: #0000cc; LINE-HEIGHT: 45px; FONT-FAMILY: "宋体"; TEXT-DECORATION: none
}
.style3 {FONT-WEIGHT: bold; FONT-SIZE: 36px; COLOR: #0000cc; LINE-HEIGHT: 45px; FONT-FAMILY: "宋体"; TEXT-DECORATION: underline; }
.style4 {font-size: 12px}
.style5 {FONT-WEIGHT: bold; FONT-SIZE: 28px; COLOR: #0000cc; LINE-HEIGHT: 45px; FONT-FAMILY: "宋体"; TEXT-DECORATION: none; }
.q12 { FONT-SIZE: 12px; COLOR: #666666; FONT-FAMILY: "Arial", "Helvetica", "sans-serif"; TEXT-DECORATION: none
}
.style7 {FONT-SIZE: 12px; COLOR: #333333; FONT-FAMILY: "Arial", "Helvetica", "sans-serif"; TEXT-DECORATION: none; }
-->
</style>
</head>
<!--表单确认代码-->
<script language="javascript">
<!--
function check()
{
if(document.form1.biao.value.length=="")
{
alert("请写上标题!");
document.form1.biao.focus();
return false;
}
if(document.form1.nei.value.length=="")
{
alert("请写上内容!");
this.form1.nei.focus();
return false;
}
return true;
}
-->
</script>
<body>
<?
$page_size=60;
require"../conn.php";
//$id = str_replace(" ","&nbsp;",$id);
//echo $id."<BR>";
$id = str_replace("?"," ",$id);
//echo $id."<BR>".$id2."<BR>";
//$id = str_replace("&nbsp;","",$id);
if($id2==''||$id2=='{xw_id}')
$sql="select * from pinglun where biaoti='$id' and shenhe<>'' order by id desc";
else
$sql="select * from pinglun where id2='$id2' and shenhe<>'' order by id desc";
if($id=='一年内飙升约40% 丽水政府被质疑姑息哄炒房价')
$sql="select * from pinglun where biaoti='$id' and shenhe<>'' order by id desc";;
//echo $sql."<BR>";
$result=mysql_query($sql,$mylink);
if($result)
{
//取得返回的记录总数
$message_count=mysql_num_rows($result);

//取得总共的页码
$page_count=ceil($message_count/$page_size);

if($page<=0) $page=1;
if($page>=$page_count) $page=$page_count;

//取得当前页的首条记录位置
$offset=($page-1)*$page_size;

} //返回当前页中的所有记录
if($id2==''||$id2=='{xw_id}')
{
$sql = "select * from pinglun where biaoti like '%$id%' and shenhe<>'' order by id desc limit $offset,$page_size";
//echo $sql;
}
else
$sql = "select * from pinglun where id2='$id2' and shenhe<>'' order by id desc limit $offset,$page_size";
if($id=='一年内飙升约40% 丽水政府被质疑姑息哄炒房价')
$sql="select * from pinglun where biaoti='$id' and shenhe<>'' order by id desc";;
$result=mysql_query($sql,$mylink);
?>
<table width="773" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td colspan="2"><iframe name=people marginwidth=0 marginheight=0 src="http://house.people.com.cn/qianru/heads.html"
frameborder=0 noResize width="773" scrolling=no height="110"></iframe>
</td>
</tr>
<tr>
<td width="229" valign="top"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="172" valign="top" background="http://house.people.com.cn/simages/logo_wypl.gif"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="19" align="center"><object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=5,0,0,0" width="165" height="19">
<param name=movie value="http://house.people.com.cn/images_new/title_top_04.swf">
<param name=quality value=high>
<param name="wmode" value="transparent">
<embed src="http://house.people.com.cn/images_new/title_top_04.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="165" height="19" wmode="transparent"> </embed>
</object></td>
</tr>
</table></td>
</tr>
</table>
<table width="80%" height="3" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="27" background="http://house.people.com.cn/simages/dhbg08x.gif"><div align="center">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="180" height="21">
<param name="movie" value="http://house.people.com.cn/simages/banner_juece.swf">
<param name="quality" value="high">
<param name="wmode" value="transparent">
<embed src="http://house.people.com.cn/simages/banner_juece.swf" width="180" height="21" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" wmode="transparent"></embed>
</object>
</div></td>
</tr>
</table></td>
<td valign="top"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="108" colspan="2"><iframe name=shengming marginwidth=0 marginheight=0 src="http://house.people.com.cn/qianru/banner_2.html"
frameborder=0 noResize width="544" scrolling=no height="108"></iframe>
</td>
</tr>
<tr>
<td height="94" colspan="2"><iframe name=shengming marginwidth=0 marginheight=0 src="http://house.people.com.cn/qianru/dh.html"
frameborder=0 noResize width="544" scrolling=no height="94"></iframe></td>
</tr>
</table></td>
</tr>
</table>
<table width="80%" height="3" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
<table width="773" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td valign="bottom" bgcolor="#DDF2FB"><div align="center" class="style3">
<table width="100%" height="3" border="0" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
<p class="style5">
<?php
if(!empty($id2))
echo '<a target="_blank" href="../xinwen/'.substr($id2,0,6).'/article_'.substr($id2,6).'.html">'.$id.'</a>';
else {
$sql3 = "select * from xinwen where biaoti like'%$id%' limit 0,1";
//echo $sql3;
$result3 = mysql_query($sql3);
$array3 = mysql_fetch_array($result3);
echo '<a target="_blank" href="../xinwen'.$array3['mkdir'].'article_'.$array3['dizhi'].'.html">'.$id.'</a></a>';
}
?>
</div></td>
</tr>
<tr>
<td bgcolor="#DDF2FB"><div align="center"><span class="style4"><FONT color=#ff0000>（以下评论仅表达网友个人观点，不代表人民网立场和观点。）</FONT></span></div></td>
</tr>
</table>
<table width="773" height="27" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td width="2%" bgcolor="#78BAFF">&nbsp;</td>
<td width="89%" bgcolor="#78BAFF"><div align="left"><span class="style2">网友评论</span></div></td>
<td width="9%" bgcolor="#78BAFF"><span class="style2">共<?php echo $message_count;?>条</span></td>
</tr>
</table>
<?php
if($result)
{
while($myarray=mysql_fetch_array($result))
{
?>
<TABLE cellSpacing=0 cellPadding=0 width="773" align=center
border=0>
<TBODY>
<TR bgColor=#ddf2fb>
<TD class=font-b align=middle width="8%"
height=25><div align="center"><img src="../images/02.gif" width="30" height="25"></div></TD>
<TD class=font-b width="59%"><div align="left"><strong><? echo $myarray["biao"];?></strong></div></TD>
<TD width="24%" class=font-b><div align="left"></div>
<div align="left"><span class="style7">发言时间 : <? echo $myarray["shijian"];?></span></div></TD>
<TD align=right width="9%" bgColor=#ddf2fb><div align="left"></div></TD>
</TR>
<TR>
<TD class=font-b align=middle height=31>&nbsp;</TD>
<TD height=31 colSpan=3 valign="top"><div align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0" style="table-layout:fixed;word-break:break-all "
>
<tr>
<td height="6"></td>
</tr>
<tr>
<td><?echo $myarray["neirong"];?></td>
</tr>
<tr>
<td height="6"></td>
</tr>
</table>
</div></TD>
</TR>
</TBODY>
</TABLE>
<?php }?>
<TABLE cellSpacing=0 cellPadding=0 width="773" align=center
border=0>
<TBODY>
<TR>
<TD align=middle width=988 height=30>
<div align="center">
<?
$prev_page=$page-1;
$next_page=$page+1;
if ($page<=1) echo "第一页";
else echo "<a href='$path_info?page=1&id=$id'>第一页</a>";
echo "&nbsp;";
if ($prev_page<1) echo "上一页";
else echo "<a href='$path_info?page=$prev_page&id=$id'>上一页</a>";
echo "&nbsp;";

if ($next_page>$page_count) echo "下一页";
else echo "<a href='$path_info?page=$next_page&id=$id'>下一页</a>";
echo "&nbsp;";
if ($page>=$page_count) echo "最后一页";
else echo "<a href='$PATH_INFO?page=$page_count&id=$id'>最后一页</a>";
?>
</div>
<?
}
else
{
echo "暂时还没有留言。";
}
?>
</TD>
</TR>
</TBODY>
</TABLE>
<table width="80%" height="3" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="3"></td>
</tr>
</table>
<table width="773" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td width="400" valign="top"><TABLE cellSpacing=1 cellPadding=0 width="400"
bgColor=#78baff border=0>
<TBODY>
<TR>
<TD vAlign=top align=middle height=42><table width="100%" height="27" border="0" cellpadding="0" cellspacing="0">
<tr>
<td><div align="center"><span class="style2">网友发表评论</span></div></td>
</tr>
</table>
<TABLE cellSpacing=0 cellPadding=1 width="100%"
bgColor=#ddf3ff border=0> <form action="addpinlun.php" method="post" name="form1" onSubmit="return check()">
<TBODY>
<TR>
<TD width="3%" height=15 align=middle><div align="left"></div></TD>
<TD width="13%" height=35 align=left valign="middle"><div align="left"><FONT
color=#000000>标题</FONT>：</div></TD>
<TD width="84%"><div align="left">
<INPUT id=biao2 maxLength=42 size=30
name=biao>
<input type="hidden" name="biaoti" value="<? echo $id;?>">
<input type="hidden" name="id2" value="<? echo $id2;?>">
</div></TD>
</TR>
<TR>
<TD height=170 align=middle vAlign=top><div align="left"><BR>
</div></TD>
<TD height=170 align=middle vAlign=top><div align="left">
<table width="100%" height="5" border="0" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
<SPAN
class=fblack>内容：</SPAN></div></TD>
<TD height=150><div align="left">
<TEXTAREA id=nei name=nei rows=12 cols=48></TEXTAREA>
<table width="100%" height="6" border="0" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
</div></TD>
</TR>
</TBODY></from>
</TABLE>
</TD>
</TR>
<TR>
<TD align=middle bgColor=#ddf3ff height=45><div align="center">
<table width="80%" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td width="46%"><div align="right">
<INPUT type=submit value=提交 name=Submit2>
</div></td>
<td width="8%">&nbsp;</td>
<td width="46%"><div align="left">
<INPUT type=reset value=重写 name=reset>
</div></td>
</tr>
</table>
</div></TD>
</TR>
</TBODY>
</TABLE></td>
<td width="5"></td>
<td width="368" valign="top"><TABLE cellSpacing=1 cellPadding=0 width="100%"
bgColor=#78baff border=0>
<TBODY>
<TR>
<TD height=121 align=middle vAlign=top bgcolor="#DDF3FF"><table width="100%" height="27" border="0" cellpadding="0" cellspacing="0">
<tr>
<td bgcolor="#78BAFF"><div align="center"><span class="style2">网友热门评论</span></div></td>
</tr>
</table>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><iframe name=bottom_gg marginwidth=0 marginheight=0 src="http://house.people.com.cn/qianru/top_pinglun.html"
frameborder=0 noResize height="266" width="365" scrolling=no></iframe></td>
</tr>
</table></TD>
</TR>
</TBODY>
</TABLE></td>
</tr>
</table>
<table width="100%" height="4" border="0" cellpadding="0" cellspacing="0">
<tr>
<td></td>
</tr>
</table>
<table width="773" border="0" align="center" cellpadding="0" cellspacing="0">
<tr align="center">
<td><iframe name=bottom_gg marginwidth=0 marginheight=0 src="../qianru/bottom_gg.html"
frameborder=0 noResize height="114" width="773" scrolling=no></iframe></td>
</tr>
<tr align="center">
<td><iframe src="../qianru/lanmu.html" height="100" width="773" scrolling="no" marginheight="0" frameborder="0"></iframe></td>
</tr>
</table>
</body>
</html>
<?
mysql_close($mylink);
?>

修复方案：

php.ini中开启短标签short_open_tag=On.或修改php源码把<?替换为<?php

版权声明：转载请注明来源 小雨@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：1

确认时间：2012-02-17 15:21

厂商回复：

CNVD确认漏洞情况，因目标重复，给予rank 1。
一并协调涉事单位处置。

最新状态：

暂无