SiteEngine 博卡网站引擎管理系统5.1.0 存在文件上传漏洞


添加时间:
2010-10-04

系统编号:
WAVDB-01704

影响版本:
SiteEngine CMS 5.1.0

程序介绍:

网站引擎(SiteEngine,全称：博卡网站引擎管理系统)，软件基于PHP程序和Mysql数据库开发，采用B/S体系结构。

漏洞分析:

首先先看第一段代码.是对文件后缀进行检查的。

 
  1. {     
  2.                 $attach['name'] = $filename = str_replace( " ", "", $attach['name'] );  //去掉文件名的空格  
  3.                 $attach['ext'] = $extension = strtolower( fileext( $attach['name'] ) ); //取得文件的后缀名并变成小写  
  4.                      
  5.                 //转义文件后缀名的正则表达式字符，并匹配合法的文件后缀名     
  6.                 if ( $attachextensions && !preg_match( "/(^|\\s|,)".preg_quote( $attach['ext'], "/" )."(\$|\\s|,)/i", $attachextensions ) )       
  7.                 {     
  8.                         //如果不匹配   majun1988 good  
  9.                         message( $GLOBALS['l_site']['uploadexterror'], $referer );     
  10.                 }    
这段代码我们可以看出SiteEngine对上传的文件后缀进行检查.符合$attachextensions即可上传,否则提示错误。
 
再看第二段代码：
 
  1. //文件名处理     
  2.                         $filename = substr( $filename, 0, strlen( $filename ) - strlen( $extension ) - 1 ); //取出文件的后缀名之后 得出真实的文件名     
  3.                         if ( preg_match( "/([-]|\\%)+/s", $filename ) )   //如果文件名存在非法字符   司徒生辰快乐  
  4.                         {     
  5.                                 $filename = str_replace( "/", "", base64_encode( substr( $filename, 0, 20 ) ) );    //取文件名前20位数，用base64进行编码，然后把转义符去掉     
  6.                         }     
  7.                         if ( $avatar ) //如果设置了某个头像的参数   
  8.                         {     
  9.                                 //隔一个标点符号就将 .（点） 转化为 _ （下划线）      
  10.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", $avatar.".gif" );     
  11.                         }     
  12.                         else if ( $random == 1 ) //随机参数为1     
  13.                         {     
  14.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", substr( $filename, 0, 64 )."_".random( 6 ).".".$extension ); //随机生成文件名   
  15.                         }     
  16.                         else    
  17.                         {     
  18.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", substr( $filename, 0, 64 ).".".$extension );     
  19.                         }     
第二段代码我们可以看出.上传文件文件名如含有非法字符.即取文件名前20位base64编码。如上传后缀为php.php3.php4.jsp等文件.就会将文件前的第一个"."转换成"_"
 
SiteEngine对上传文件的处理做得非常好。这种做法存在漏洞
 
首先第一点.第一段代码中的$attachextensions我寻遍了所有文件都找不到。那他的文件后缀检查就形同虚设.


漏洞利用:

 
  1. <?php  
  2. /*********************/  
  3. /*                   */  
  4. /*  Version : 5.1.0  */  
  5. /*  Author  : RM     */  
  6. /*  Comment : 071223 */  
  7. /*                   */  
  8. /*********************/  
  9.   
  10. function disuploadedfile( $file )  
  11. {  
  12.         return function_exists( "is_uploaded_file" ) && is_uploaded_file( $file ) ? TRUE : FALSE;  
  13. }  
  14.   
  15. function upload( $dir = "", $thumb = "", $avatar = "", $allowed = array( ), $random = 1, $varname = "photo" )  
  16. {  
  17.         global $db;  
  18.         global $tablepre;  
  19.         global $extension;  
  20.         global $typemaxsize;  
  21.         global $allowsetattachperm;  
  22.         global $referer;  
  23.         global $attachperm;  
  24.         global $module;  
  25.         global $classid;  
  26.         global $config_watermark;  
  27.         global $config_watermarkfont;  
  28.         global $attachsave;  
  29.         global $attachdir;  
  30.         global $maxattachsize;  
  31.         global $maxsizeperday;  
  32.         global $attachextensions;  
  33.         global $site_engine_root;  
  34.         global $resizewidth;  
  35.         global $resizeheight;  
  36.         global $uploaddir;  
  37.         global $sesettings;  
  38.         $attachments = $attacharray = array( );  
  39.         if ( is_array( $_FILES ) && !emptyempty( $_FILES ) )  //≈–∂œ…œ¥´Œƒº˛≤Œ ˝Œ™ ˝◊È  
  40.         {  
  41.                 foreach ( $GLOBALS['_FILES'] as $k => $v )  //»°µ√»´æ÷…œ¥´Œƒº˛£¨∂‡Œƒº˛¥¶¿Ì  
  42.                 {  
  43.                         foreach ( $GLOBALS['_FILES'][$k] as $key => $var )    
  44.                         {  
  45.                                 if ( isset( $_FILES[$k] ) && is_array( $_FILES[$k] ) && $_FILES[$k]['error'] != 4 )  
  46.                                 {  
  47.                                         if ( is_array( $var ) )  
  48.                                         {  
  49.                                                 foreach ( $var as $id => $val ) //∂‡Œƒº˛…œ¥´  
  50.                                                 {  
  51.                                                         $attachments[$k][$id][$key] = $val;  
  52.                                                         $attachments[$k][$id]['module'] = $k;  
  53.                                                         $attachments[$k][$id]['description'] = $_POST[$k."description"][$id];  
  54.                                                 }  
  55.                                         }  
  56.                                         else    //µ•Œƒº˛…œ¥´  
  57.                                         {  
  58.                                                 $attachments[$k][0] = $v;  
  59.                                                 $attachments[$k][0]['module'] = $k;  
  60.                                                 $attachments[$k][0]['description'] = $_POST[$k."description"][$id];  
  61.                                         }  
  62.                                 }  
  63.                         }  
  64.                 }  
  65.         }  
  66.         $newattachments = array( );  
  67.         if ( is_array( $attachments ) ) //—È÷§ «∑ÒŒ™ ˝◊È  
  68.         {  
  69.                 foreach ( $attachments as $key => $value )  
  70.                 {  
  71.                         foreach ( $value as $k => $v )  
  72.                         {  
  73.                                 $newattachments[] = $v;  //…œ¥´±‰¡ø◊È∫œ≥… ˝◊È  
  74.                         }  
  75.                 }  
  76.         }  
  77.         foreach ( $newattachments as $key => $attach )  
  78.         {  
  79.                 $attach_saved = false;  
  80.                 if ( !( $attach['tmp_name'] != "none" && $attach['tmp_name'] && $attach['name'] ) )  //ºŸ»Á…œ¥´Œƒº˛≤ªŒ™ø’  
  81.                 {  
  82.                 }  
  83.                 else  
  84.                 {  
  85.                         $attach['name'] = $filename = str_replace( " ", "", $attach['name'] );  //»•µÙŒƒº˛√˚µƒø’∏Ò  
  86.                         $attach['ext'] = $extension = strtolower( fileext( $attach['name'] ) ); //»°µ√Œƒº˛µƒ∫Û◊∫√˚≤¢±‰≥…–°–¥  
  87.                           
  88.                         //◊™“ÂŒƒº˛∫Û◊∫√˚µƒ’˝‘ڱ̥ԠΩ◊÷∑˚£¨≤¢∆•≈‰∫œ∑®µƒŒƒº˛∫Û◊∫√˚  
  89.                         if ( $attachextensions && !preg_match( "/(^|\\s|,)".preg_quote( $attach['ext'], "/" )."(\$|\\s|,)/i", $attachextensions ) )    
  90.                         {  
  91.                                 //»Áπ˚≤ª∆•≈‰  
  92.                                 message( $GLOBALS['l_site']['uploadexterror'], $referer );  
  93.                         }  
  94.                           
  95.                         //—È÷§Œƒº˛¥Û–°  
  96.                         if ( !$attach['size'] || $maxattachsize && $maxattachsize < $attach['size'] )  
  97.                         {  
  98.                                 message( $GLOBALS['l_site']['toobig'], $referer );  
  99.                         }  
  100.                           
  101.                           
  102.                         if ( $attachsave ) //»´æ÷ø™πÿ£¨π¿º∆ «‘ –Ì¥¢¥Ê  
  103.                         {  
  104.                                 if ( $dir ) //»Áπ˚…Ë÷√¡À¥¢¥Êƒø¬º  
  105.                                 {  
  106.                                         $attach_subdir = $dir;  
  107.                                 }  
  108.                                 else  
  109.                                 {  
  110.                                         switch ( $attachsave ) //—°‘Ò¥¢¥Êƒ£ Ω£®√ø÷÷ƒ£ Ωµƒƒø¬º√˚≤ª“ª—˘£©  
  111.                                         {  
  112.                                         case 1 :  
  113.                                                 $attach_subdir = $module;  
  114.                                                 break;  
  115.                                         case 2 :  
  116.                                                 $attach_subdir = "ext_".$extension;  
  117.                                                 break;  
  118.                                         case 3 :  
  119.                                                 $attach_subdir = "month_".date( "ym" );  
  120.                                                 break;  
  121.                                         case 4 :  
  122.                                                 $attach_subdir = "day_".date( "ymd" );  
  123.                                         }  
  124.                                 }  
  125.                                 $attach_dir = $attachdir."/".$attach_subdir; //µ√µΩ¥Ê¥¢µƒæ¯∂‘¬∑æ∂  
  126.                                 if ( !is_dir( $attachdir."/".$module ) )  //≈–∂œ¥¢¥Êƒ£ Ω1 µƒæ¯∂‘¬∑æ∂  
  127.                                 {  
  128.                                         @mkdir( $attachdir."/".$module, 511 );  
  129.                                         @chmod( $$attachdir."/".$module, 511 );  
  130.                                         @fclose( @fopen( $attachdir."/".$module."/index.htm", "w" ) );  
  131.                                         if ( $module == "photo" && !is_dir( $site_engine_root.$uploaddir."/photo/thumbs" ) )  
  132.                                         {  
  133.                                                 @mkdir( $site_engine_root.$uploaddir."/photo/thumbs", 511 );  
  134.                                         }  
  135.                                 }  
  136.                                 if ( !is_dir( $attach_dir ) )   //≈–∂œ¥¢¥Êƒ£ Ω2 µƒæ¯∂‘¬∑æ∂  
  137.                                 {  
  138.                                         @mkdir( $attach_dir, 511 );  
  139.                                         @chmod( $attach_dir, 511 );  
  140.                                         @fclose( @fopen( $attach_dir."/index.htm", "w" ) );  
  141.                                 }  
  142.                                 $attach['attachment'] = $attach_subdir."/";  
  143.                         }  
  144.                         else    //≤ª‘ –̥ʥ¢µƒ«Èøˆ£¨ ‹”∞œÏƒø¬ºŒ™ø’  
  145.                         {  
  146.                                 $attach['attachment'] = "";  
  147.                         }  
  148.                           
  149.                           
  150.                         //Œƒº˛√˚¥¶¿Ì  
  151.                         $filename = substr( $filename, 0, strlen( $filename ) - strlen( $extension ) - 1 ); //»°≥ˆŒƒº˛µƒ∫Û◊∫√˚÷Æ∫Û µ√≥ˆ’Ê µµƒŒƒº˛√˚  
  152.                         if ( preg_match( "/([-ˇ]|\\%)+/s", $filename ) )   //»Áπ˚Œƒº˛√˚¥Ê‘⁄∑«∑®◊÷∑˚  
  153.                         {  
  154.                                 $filename = str_replace( "/", "", base64_encode( substr( $filename, 0, 20 ) ) );    //»°Œƒº˛√˚«∞20Œª ˝£¨”√base64Ω¯––±‡¬Î£¨»ª∫Û∞—◊™“Â∑˚»•µÙ  
  155.                         }  
  156.                         if ( $avatar ) //»Áπ˚…Ë÷√¡Àƒ≥∏ˆÕ∑œÒµƒ≤Œ ˝  
  157.                         {  
  158.                                 //∏Ù“ª∏ˆ±Íµ„∑˚∫≈æÕΩ´ .£®µ„£© ◊™ªØŒ™ _ £®œ¬ªÆœfl£©   
  159.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", $avatar.".gif" );  
  160.                         }  
  161.                         else if ( $random == 1 ) //Àʪ˙≤Œ ˝Œ™1  
  162.                         {  
  163.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", substr( $filename, 0, 64 )."_".random( 6 ).".".$extension ); //Àʪ˙…˙≥…Œƒº˛√˚  
  164.                         }  
  165.                         else  
  166.                         {  
  167.                                 $attach['attachment'] .= preg_replace( "/(\\.)(php|phtml|pwml|php3|php4|php|php2|inc|jsp|exe|dll|asp|aspx|cgi|fcgi|pl|reg)(\\.|\$)/i", "\\1_\\2\\3", substr( $filename, 0, 64 ).".".$extension );  
  168.                         }  
  169.                         $target = $attachdir."/".stripslashes( $attach['attachment'] );  
  170.                         if ( copy( $attach['tmp_name'], $target ) || function_exists( "move_uploaded_file" ) && move_uploaded_file( $attach['tmp_name'], $target ) )  
  171.                         {  
  172.                                 $attach_saved = true;  
  173.                         }  
  174.                         if ( !$attach_saved && is_readable( $attach['tmp_name'] ) )  
  175.                         {  
  176.                                 @$fp = @fopen( $attach, "rb" );  
  177.                                 @flock( $fp, 2 );  
  178.                                 @$attachedfile = @fread( $fp, $attach['size'] );  
  179.                                 @fclose( $fp );  
  180.                                 @$fp = @fopen( $target, "wb" );  
  181.                                 @flock( $fp, 2 );  
  182.                                 if ( @fwrite( $fp, $attachedfile ) )  
  183.                                 {  
  184.                                         $attach_saved = true;  
  185.                                 }  
  186.                                 @chmod( $site_engine_root.$uploaddir.$attach['attachment'], 511 );  
  187.                                 @fclose( $fp );  
  188.                         }  
  189.                         if ( $attach_saved )  
  190.                         {  
  191.                                 if ( is_array( $attach ) && $thumb == 1 && $attach['size'] )  
  192.                                 {  
  193.                                         do  
  194.                                         {  
  195.                                                 require_once( $site_engine_root."lib/photo.php" );  
  196.                                                 $exif = new phpexifreader( $site_engine_root.$uploaddir.$attach['attachment'] );  
  197.                                                 $exif->processfile( );  
  198.                                                 $photoinfo = $exif->getimageinfo( );  
  199.                                                 if ( ( strtolower( $attach['type'] ) == "image/pjpeg" || $attach['type'] == "image/jpeg" ) && function_exists( "imagecreatefromjpeg" ) )  
  200.                                                 {  
  201.                                                         $im = @imagecreatefromjpeg( $attach['tmp_name'] );  
  202.                                                 }  
  203.                                                 else  
  204.                                                 {  
  205.                                                         if ( $var['type'] == "image/x-png" && function_exists( "imagecreatefrompng" ) )  
  206.                                                         {  
  207.                                                                 $im = @imagecreatefrompng( $attach['tmp_name'] );  
  208.                                                         }  
  209.                                                         else if ( !( $var['type'] == "image/gif" && function_exists( "imagecreatefromgif" ) ) )  
  210.                                                         {  
  211.                                                                 break;  
  212.                                                         }  
  213.                                                         else  
  214.                                                         {  
  215.                                                                 $im = @imagecreatefromgif( $attach['tmp_name'] );  
  216.                                                                 continue;  
  217.                                                         }  
  218.                                                 }  
  219.                                                 $name = "";  
  220.                                                 if ( $im )  
  221.                                                 {  
  222.                                                         $name = resizeimage( $im, $GLOBALS['photosystem']['maxsize'], $GLOBALS['photosystem']['maxsize'], $attach['attachment'], 1 );  
  223.                                                 }  
  224.                                                 if ( $sesettings['system']['photosize'] )  
  225.                                                 {  
  226.                                                         $name1 = resizeimage( $im, $sesettings['system']['photosize'], $sesettings['system']['photosize'], $attach['attachment'] );  
  227.                                                         imagedestroy( $im );  
  228.                                                 }  
  229.                                                 if ( is_array( $photoinfo ) && $photosystem['exif'] == 1 )  
  230.                                                 {  
  231.                                                         foreach ( $photoinfo as $k => $v )  
  232.                                                         {  
  233.                                                                 $k = strtolower( $k );  
  234.                                                                 $attach[$k] = shtmlspecialchars( $v );  
  235.                                                         }  
  236.                                                 }  
  237.                                                 $attach['thumb'] = $name;  
  238.                                                 $attach[$key] = $attach['module'];  
  239.                                         } while ( 0 );  
  240.                                 }  
  241.                                 $img_info = @getimagesize( $target );  
  242.                                 if ( in_array( $attach['ext'], array( "jpg", "gif", "png", "bmp" ) ) && function_exists( "getimagesize" ) && !getimagesize( $target ) && $admincp != 1 )  
  243.                                 {  
  244.                                         @unlink( $target );  
  245.                                 }  
  246.                                 else  
  247.                                 {  
  248.                                         if ( in_array( $attach['ext'], array( "jpg", "gif", "png" ) ) && function_exists( "getimagesize" ) && function_exists( "imagettftext" ) && @getimagesize( $target ) && isset( $_POST[$attach['module']."_watermark"] ) && intval( $_POST[$attach['module']."_watermark"] ) == 1 )  
  249.                                         {  
  250.                                                 require_once( $site_engine_root."lib/watermark.php" );  
  251.                                                 $tmp_image = new gimage( );  
  252.                                                 if ( !ereg( "^http://", $config_watermark ) )  
  253.                                                 {  
  254.                                                         $tmp_image->wm_text = $config_watermark;  
  255.                                                 }  
  256.                                                 else  
  257.                                                 {  
  258.                                                         $tmp_image->wm_image_name = $config_watermark;  
  259.                                                 }  
  260.                                                 $tmp_image->wm_text_font = $site_engine_root."data/fonts/".$config_watermarkfont;  
  261.                                                 $tmp_image->save_file = $target;  
  262.                                                 $tmp_image->create( $target );  
  263.                                         }  
  264.                                         $attach['perm'] = $allowsetattachperm ? $attachperm[$key] : 0;  
  265.                                         $attach['key'] = $key;  
  266.                                         $attacharray[] = $attach;  
  267.                                 }  
  268.                         }  
  269.                         else  
  270.                         {  
  271.                                 message( $GLOBALS['l_site']['saveerror'], $referer );  
  272.                         }  
  273.                 }  
  274.         }  
  275.         unset( $extension );  
  276.         return !emptyempty( $attacharray ) ? $attacharray : false;  
  277. }  
  278.   
  279. function resizeimage( $im, $maxwidth, $maxheight, $name, $isthumb = "" )  
  280. {  
  281.         global $module;  
  282.         global $attachdir;  
  283.         global $site_engine_root;  
  284.         if ( $isthumb == 1 )  
  285.         {  
  286.                 $name = str_replace( $module, $module."/thumbs", $name );  
  287.         }  
  288.         else  
  289.         {  
  290.                 $name = str_replace( $module, $module, $name );  
  291.         }  
  292.         $width = imagesx( $im );  
  293.         $height = imagesy( $im );  
  294.         $resizewidth = $resizeheight = false;  
  295.         if ( $maxwidth && $maxwidth < $width || $maxheight && $maxheight < $height )  
  296.         {  
  297.                 if ( $maxwidth && $maxwidth < $width )  
  298.                 {  
  299.                         $widthratio = $maxwidth / $width;  
  300.                         $resizewidth = true;  
  301.                 }  
  302.                 if ( $maxheight && $maxheight < $height )  
  303.                 {  
  304.                         $heightratio = $maxheight / $height;  
  305.                         $resizeheight = true;  
  306.                 }  
  307.                 if ( $resizewidth && $resizeheight )  
  308.                 {  
  309.                         if ( $widthratio < $heightratio )  
  310.                         {  
  311.                                 $ratio = $widthratio;  
  312.                         }  
  313.                         else  
  314.                         {  
  315.                                 $ratio = $heightratio;  
  316.                         }  
  317.                 }  
  318.                 else if ( $resizewidth )  
  319.                 {  
  320.                         $ratio = $widthratio;  
  321.                 }  
  322.                 else if ( $resizeheight )  
  323.                 {  
  324.                         $ratio = $heightratio;  
  325.                 }  
  326.                 $newwidth = $width * $ratio;  
  327.                 $newheight = $height * $ratio;  
  328.                 if ( function_exists( "imagecopyresampled" ) )  
  329.                 {  
  330.                         $newim = imagecreatetruecolor( $newwidth, $newheight );  
  331.                         imagecopyresampled( $newim, $im, 0, 0, 0, 0, $newwidth, $newheight, $width, $height );  
  332.                 }  
  333.                 else  
  334.                 {  
  335.                         $newim = imagecreate( $newwidth, $newheight );  
  336.                         imagecopyresized( $newim, $im, 0, 0, 0, 0, $newwidth, $newheight, $width, $height );  
  337.                 }  
  338.                 @imagejpeg( $newim, $attachdir."/".$name );  
  339.                 imagedestroy( $newim );  
  340.         }  
  341.         else  
  342.         {  
  343.                 @imagejpeg( $im, $attachdir."/".$name );  
  344.         }  
  345.         return $name;  
  346. }  
  347.   
  348. if ( !defined( "IN_SITEENGINE" ) )  
  349. {  
  350.         exit( "Access Denied" );  
  351. }  
  352. $maxgroupcache = groupcache( $usergroup, array( "maxattachsize", "attachextensions" ), 1 );  
  353. $maxattachsize = $maxgroupcache['maxattachsize'] ? $maxgroupcache['maxattachsize'] : 1024000000;  
  354. $attachsave = 1;  
  355. $attachdir = $site_engine_root.$uploaddir;  
  356. eval( "\$header = \"".$tpl->get( "header", $templates, $language )."\";" );  
  357. $debuginfo = gettotaltime( );  
  358. eval( "\$footer = \"".$tpl->get( "footer", $templates, $language )."\";" );  
  359. if ( !emptyempty( $usergroup ) && $maxgroupcache['attachextensions'] )  
  360. {  
  361.         $attachextensions = $maxgroupcache['attachextensions'];  
  362. }  
  363. ?>  
 

 

 



解决方案:
厂商补丁：
SiteEngine
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.siteengine.net/

信息来源:
<* 来源: majun1988
链接: http://majun1988.cngxr.com/?action=show&id=416
*>