当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2012-06702

漏洞标题：新浪分站部分源代码泄露,可进一步利用

相关厂商：新浪

漏洞作者： 蟋蟀哥哥

提交时间：2012-05-05 11:42

修复时间：2012-06-19 11:43

公开时间：2012-06-19 11:43

漏洞类型：重要敏感信息泄露

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2012-05-05： 细节已通知厂商并且等待厂商处理中
2012-05-05： 厂商已经确认，细节仅向厂商公开
2012-05-15： 细节向核心白帽子及相关领域专家公开
2012-05-25： 细节向普通白帽子公开
2012-06-04： 细节向实习白帽子公开
2012-06-19： 细节向公众公开

简要描述：

新浪分站部分源代码泄露,可进一步利用

详细说明：

新浪分站部分源代码泄露,可进一步利用.
昨天送的礼物全被抢了，再求礼物.谢谢

漏洞证明：

http://eladies.sina.com.tw/getnews.php~

<?php
//**********************************************************
// 
include_once "./include/define.php";
if(!defined("NO_LOGIN_HANDLE_METHOD")){
    define("NO_LOGIN_HANDLE_METHOD", NO_LOGIN_CONTINUE);}
include_once DEFAULT_DOC_ROOT."/include/smarty.php";
include_once DEFAULT_DOC_ROOT."/common/initialize.php";
include_once DEFAULT_DOC_ROOT."/util/network.php";
include_once DEFAULT_DOC_ROOT."/util/str_process.php";
include_once DEFAULT_DOC_ROOT."/include/eladies.php";
/*
process ...
*/
$op     = Request_Param("op","","request");
$smarty = new Template;
$smarty->assign('WWW_ROOT',DEFAULT_WWW_ROOT);
$smarty->assign('DEFAULT_DOC_ROOT',DEFAULT_DOC_ROOT);
$smarty->assign('WWW_ROOT_IMAGES',WWW_ROOT_IMAGE);
$smarty->assign('WWW_ROOT_CSS',WWW_ROOT_CSS);
$smarty->assign('WWW_ROOT_JS',WWW_ROOT_JS);
$smarty->assign('UPDATE_IMAES',UPDATE_IMAES);
$smarty->assign('INCLUDE_TMPL_ROOT',INCLUDE_TMPL_ROOT);
$smarty->assign('CRON_INDEX_TMPL',CRON_INDEX_TMPL);
$smarty->assign('WWW_EXTRATMPL_ROOT',DEFAULT_WWW_ROOT."/templates/extratmpl");
if( !empty( $MemberInfo ) && isset($MemberInfo["NickName"])){
	$smarty->assign('USER_NAME', $MemberInfo["NickName"] );
}
$connect = mysql_connect(ELADIES_WDB_HOST,ELADIES_WDB_USER,ELADIES_WDB_PASS) or die("資料庫連線錯誤,請聯絡管理員");
mysql_select_db(ELADIES_WDB_NAME,$connect);
//
//**********************************************************
include_once "./include/define.php";
if(!defined("NO_LOGIN_HANDLE_METHOD")){
    define("NO_LOGIN_HANDLE_METHOD", NO_LOGIN_CONTINUE);
}
include_once DEFAULT_DOC_ROOT."/include/smarty.php";
include_once DEFAULT_DOC_ROOT."/common/initialize.php";
include_once DEFAULT_DOC_ROOT."/util/network.php";
include_once DEFAULT_DOC_ROOT."/include/eladies.php";
include_once DEFAULT_DOC_ROOT."/include/dict.php";
$id  = Request_Param("newsid","","request");
if( intval($id) <= 0 ){
	header("Location:http://eladies.sina.com.tw");
}
$eladies  = new Eladies();
$news = $eladies->getPubNewsById( $id );
if( !$news || empty($news) || $news['content'] == "" || $news['title'] == ""){
	header("Location:http://eladies.sina.com.tw");
}else{
	if( !$eladies->updateNewsClick( $news['newsid'])){
		header("Location:http://eladies.sina.com.tw");
	}
}
$keywords = $news['keywords'];
$conn_news = $eladies->getConnNews($id, $keywords , 8 , $news['video_count'] , $news['category']);
$category = $eladies->getCategory( $news['category']);
$tpl_layout_name = "article.shtml";
$onevision_ad_config = 0;
$change_video_type = 0;
$_common_js_clickrecord = 'news';
$news_shcont_ = mb_substr(trim(strip_tags($news['content'])),0,35,"UTF-8")." ... "; 
if( intval($news['video_count']) == 1 && $news['source'] == "tw"){ 				//only process tw
    $video = $eladies->getVideoByNewsid( $news['id'] , $news['source'] );
    $onevision_ad_config = $eladies->getOptionFunction_Onevision( 'onevision-ad-config' );
    $tpl_layout_name = "article_video.shtml"; 							//video tmpl
        
    if(isset($news['onevision_url']) && $onevision_ad_config['advertising_config'] == 1 ) {  	//only for onevision
        $change_video_type = 1;            
    }
    $_common_js_clickrecord = 'video';        
        
}elseif( intval($news['media_count']) == 1 && $news['layout'] == "11" ){
    $newsid = intval( $news['newsid']);
    $images = $eladies->getImageByNewsid( $newsid , $news['source']);
    $tpl_layout_name = "article_photo.shtml"; 							//laypout by one images tmpl
                        
}elseif( intval($news['media_count']) > 1 ){
    $newsid = intval( $news['newsid']);
	$img_album_id = $newsid;
    $images = $eladies->getImageByNewsid( $newsid ,$news['source']);
	if( !empty($images) && count($images) > 1 && file_exists(DEFAULT_DOC_ROOT."/images/flash/newsPhoto/".$newsid."_list.xml")){
        $tpl_layout_name = "article_photo02.shtml"; 						//imgnum > 1 tmpl                	
	}elseif( count($images) == 1 && $news['layout'] == "11" ){
		$tpl_layout_name = "article_photo.shtml";						
	}else{
		$tpl_layout_name = "article.shtml";			
	}
	
}
$authorid = intval( $news['author']);
$author = $eladies->getAuthor( $authorid);
$smarty = new Template;
$smarty->assign('news',$news);
$smarty->assign('author',$author);
$smarty->assign('category',$category);
$smarty->assign('share_title_content',$news_shcont_);
$smarty->assign('onevision_ad_config',$onevision_ad_config);
$smarty->assign('change_video_type',$change_video_type);
$smarty->assign('WWW_ROOT',DEFAULT_WWW_ROOT);
$smarty->assign('DEFAULT_DOC_ROOT',DEFAULT_DOC_ROOT);
$smarty->assign('WWW_ROOT_IMAGES',WWW_ROOT_IMAGE);
$smarty->assign('WWW_ROOT_CSS',WWW_ROOT_CSS);
$smarty->assign('WWW_ROOT_JS',WWW_ROOT_JS);
$smarty->assign('UPDATE_IMAES',UPDATE_IMAES);
$smarty->assign('INCLUDE_TMPL_ROOT',INCLUDE_TMPL_ROOT);
$smarty->assign('CRON_INDEX_TMPL',CRON_INDEX_TMPL);
$smarty->assign('WWW_EXTRATMPL_ROOT',DEFAULT_WWW_ROOT."/templates/extratmpl");
$patten = "/<img.*?src\s*=\s*[\"|\']?\s*([^>\"\'\s\[]*)/i";
if( preg_match( $patten , $news['content'])){
	$smarty->assign('CONTENT_IMG',"yes");
}else{
	$smarty->assign('CONTENT_IMG',"");
}
if( $images && !empty($images) ){
        $smarty->assign('first_image',$images['info'][0]['photo_image1']);
        if( intval($news['media_count']) == 1 ){
                $smarty->assign('first_image',$images['info'][0]['photo_image1']);
        }else{ //> 1
                $smarty->assign('img_album_id',$img_album_id);
        }
}
if( !empty( $MemberInfo ) && isset($MemberInfo["NickName"])){
        $smarty->assign('USER_NAME', $MemberInfo["NickName"] );}
$catid = intval($category['id']);
$topidinfo = $eladies->getCategory( $category['topid'] );
if( $catid == "1" ||  $catid == "2055" ){
	$smarty->display("todaynews/$tpl_layout_name");
	exit;
}elseif( $topidinfo && isset($topidinfo['id']) && $topidinfo['id'] != "1"){
	$topid = intval( $topidinfo['id'] );
	if( $topid == "107" ){
		$toptmpl = $tmpl_access[100]['subsection'][107]['twname'];
		$path = "<a href=\"/fashion/brands/list.shtml\">".$toptmpl."</a>";
		$catinfo = $eladies->getCategory( $catid );
                $tmpl  = $catinfo['cname'];
                $path.= " &gt; <a href=\"get_tmpl.php?op=list&tpldir=fashion&secdir=brands&catid=".$catid."\">".$catinfo['cname']."</a>";
		$tmplname = "fashion/$tpl_layout_name";
	}elseif( $topid == "357"){
		$toptmpl = $tmpl_access[101]['subsection'][357]['twname'];
		$path = "<a href=\"/beauty/brands/list.shtml\">".$toptmpl."</a>";
		$catinfo = $eladies->getCategory( $catid );
		$tmpl  = $catinfo['cname'];
		$path.= " &gt; <a href=\"get_tmpl.php?op=list&tpldir=beauty&secdir=brands&catid=".$catid."\">".$catinfo['cname']."</a>";
		$tmplname = "beauty/$tpl_layout_name";
	}else{	
		$toptmpl = $tmpl_access[$topid]['cname'];
		$path = "<a href=\"index.php?op=".$tmpl_access[$topid]['cname']."\">".$tmpl_access[$topid]['twname']."</a>";
		$tmpl  =  $tmpl_access[$topid]['subsection'][$catid]['cname'];
		$tmplname = $toptmpl."/$tpl_layout_name";
		$path.= " &gt; <a href=\"get_tmpl.php?op=list&tpldir=".$tmpl_access[$topid]['cname']."&secdir=".$tmpl_access[$topid]['subsection'][$catid]['cname']."\">".$tmpl_access[$topid]['subsection'][$catid]['twname']."</a>";
	}
}else{
		$tmpl = $tmpl_access[$catid]['cname'];
		$tmplname = $tmpl."/$tpl_layout_name";
		$path = "<a href=\"index.php?op=".$tmpl_access[$catid]['cname']."\">".$tmpl_access[$catid]['twcname']."</a>";
}
if( !$tmpl ){
	$path = "";
	$tmplname = "todaynews/$tpl_layout_name";
}
$smarty->assign("pathname",$path);
//add click record function  
//$smarty->assign('_common_js_clickrecord',$_common_js_clickrecord);
//start 1.0 buy.sina.com.tw
$HTTP_USER_AGENT=$_SERVER['HTTP_USER_AGENT'];
if(	eregi("BOT",strtoupper($HTTP_USER_AGENT)) ||
	eregi("YAHOO",strtoupper($HTTP_USER_AGENT)) ||
	eregi("GOOGLE",strtoupper($HTTP_USER_AGENT))){
	$b_newsid = intval( $news['id']);
	if($b_newsid=="22700" || $b_newsid=="22688" || $b_newsid=="22615"){	
		$smarty->assign('BUY_REQ_USER_AGENT',"1");	
	}	
} 
//end 1.0 buy.sina.com.tw
if( $conn_news && !empty($conn_news )){
	foreach( $conn_news as $key => $val ){
		$conn_news[$key]['title'] = cut_str(strip_tags($val['title']),15,null);
	}
	$smarty->assign('conn_news',$conn_news);
}else{
	$smarty->assign('conn_news',"");
}
//*************************************************************************************
//
$specialid = intval(trim($_GET['special'])) ? intval(trim($_GET['special'])) : 0;
if($specialid){
	$sql = "select title from feature where type = '0' and id = '$specialid'";
	$query = mysql_query($sql);
	$result = mysql_fetch_row($query);
	$title = $result[0];
	
	$smarty->assign('specialID',$specialid);
	$smarty->assign('title',$title);
	
	$sql = "select href,image,cshow from feature where type = '1' and ztype = '$specialid'";
	$query = mysql_query($sql);
	$result = mysql_fetch_row($query);
	list($bannerHref,$bannerImage,$bannerCshow) = $result;
	$smarty->assign('hasBanner',$bannerCshow);
	$smarty->assign('bannerHref',$bannerHref);
	$smarty->assign('bannerImage',$bannerImage);
	
	$smarty->assign('special',1);
}
if($specialid){
    if(strpos($tmplname,'video')){
        $sql = "select content,title from feature where type = '4' and ztype = '$specialid'";
	    $query = mysql_query($sql);
	    while($result = mysql_fetch_row($query)){
	       	if($result[0] == $id){
	            $about .= '<option selected>'.$result[1].'</option>';
	        }else {
	            $about .= '<option value="./pre_news.php?id='.$result[0].'&special='.$specialid.'">'.$result[1].'</option>';
	        }
	    }
		$smarty->assign('about',$about);
    }else{
		$sql = "select ctype from feature where sort='$id'";
		$query = mysql_query($sql);
		$result = mysql_fetch_row($query);
		$zflID = $result[0];
		$sql = "select sort,title from feature where type = '3' and ctype = '$zflID'";
		$query = mysql_query($sql);
		while($result = mysql_fetch_row($query)){
			if($result[0] == $id){
				$about .= '<option selected>'.$result[1].'</option>';
			}
			else {
				$about .= '<option value="./pre_news.php?id='.$result[0].'&special='.$specialid.'">'.$result[1].'</option>';
			}
		}	
		$smarty->assign('about',$about);
	}
	$sql = "select sort,title,image from feature where type = '3' and ctype = '$zflID' and sort != '$id' limit 8";
	$query = mysql_query($sql);
	while($result = mysql_fetch_row($query)){
		list($tmp['id'],$tmp['title'],$tmp['image']) = $result;
		if(!$tmp['image']){
			$tmp['image'] = 'http://eladies.sina.com.tw/images/dummy.gif';
		}
		$righ[] = $tmp;
		unset($tmp);
	}	
	$smarty->assign('righ',$righ);
}
//echo $tmplname;exit;
if($specialid){
	$nd_tmpl = explode('/',$tmplname);
	$tmplname = 'fashion/'.$nd_tmpl[1];
}
//
//*************************************************************************************
debug_log('tmplname:'.$tmplname .' ==== _common_js_clickrecord is ====' . $_common_js_clickrecord);
$eladies->replaceClickRecord($news['id'],$_common_js_clickrecord=='news'?0:1);
//
$smarty->display($tmplname);
function debug_log($str) { 
	if($fd = @fopen("/home/archive/logs/debug_result.txt", "a")) { 
		fputs($fd, $str . "\n\r"); 
		fclose($fd); 
	} 
}
?>

修复方案：

你们比我专业，你们懂的

版权声明：转载请注明来源 蟋蟀哥哥@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2012-05-05 12:39

厂商回复：

感谢提供!

最新状态：

暂无