phpcms v9 部分漏洞修复

发表时间
评论 没有

/phpcms/modules/member/index.php phpcms注入漏洞修复

定位到/phpcms/modules/member/index.php 610 行
源码:

$password = isset($_POST['password']) && trim($_POST['password']) ? trim($_POST['password']) : showmessage(L('password_empty'), HTTP_REFERER);

修改为:

$password = isset($_POST['password']) && trim($_POST['password']) ? addslashes(urldecode(trim($_POST['password']))) : showmessage(L('password_empty'), HTTP_REFERER);

/api/phpsso.php phpcms注入漏洞修复

定位到/api/phpsso.php 118行
源码:

$phpssouid = $arr['uid'];

修改为:

$phpssouid = intval($arr['uid']);

/phpcms/modules/content/down.php前台注入导致任意文件读取漏洞修复

定位到/phpcms/modules/content/down.php 17行
源码:

parse_str($a_k);

修改为:

$a_k = safe_replace($a_k); 
parse_str($a_k);

定位到/phpcms/modules/content/down.php 89行
源码:

parse_str($a_k);

修改为:

$a_k = safe_replace($a_k); 
parse_str($a_k);

定位到/phpcms/modules/content/down.php 120行
源码:

file_down($fileurl, $filename);

修改为:

$fileurl = str_replace(array('<','>'), '', $fileurl); 
file_down($fileurl, $filename);

/phpcms/modules/pay/respond.php phpcmsv9宽字节注入

定位到/phpcms/modules/pay/respond.php 16行
源码:

$payment = $this->get_by_code($_GET['code']);

修改为:

$payment = $this->get_by_code(mysql_real_escape_string($_GET['code']));

phpsso_server/phpcms/modules/phpsso/index.php phpcms注入漏洞

定位到phpsso_server/phpcms/modules/phpsso/index.php 424行
源码:

$applist = getcache('applist', 'admin');

再其下面添加代码:

foreach ($applist as $key => $value) {
    unset($applist[$key]['authkey']);
}

api/get_menu.php phpcms authkey泄漏漏洞

定位到api/get_menu.php 28行
源码:

$cachefile = str_replace(array('/', '//'), '', $cachefile);

修改为

$cachefile = str_replace(array('/', '//', '\\'), '', $cachefile);

phpcms/modules/poster/poster.php 文件中,未对输入参数$_GET[‘group’]进行严格过滤,导致注入漏洞

定位到/phpcms/modules/poster/poster.php 219行
源码:

if ($_GET['group']) {
    $group = " `".$_GET['group']."`";
    $fields = "*, COUNT(".$_GET['group'].") AS num";
    $order = " `num` DESC";
}

改为:

$_GET['group'] = addslashes(urldecode(trim($_GET['group'])));
if ($_GET['group']) {
    $_GET['group'] = preg_replace('#`#', '', $_GET['group']);
    $group = " `".$_GET['group']."`";
    $fields = "*, COUNT(".$_GET['group'].") AS num";
    $order = " `num` DESC";
}

phpcms/libs/classes/attachment.class.php某处逻辑问题导致getshell修复方案

定位到phpcms/libs/classes/attachment.class.php 144行
源码:

function download($field, $value,$watermark = '0',$ext = 'gif|jpg|jpeg|bmp|png', $absurl = '', $basehref = '')
	{
        global $image_d;
		$this->att_db = pc_base::load_model('attachment_model');
		$upload_url = pc_base::load_config('system','upload_url');
		$this->field = $field;

修改为:

function download($field, $value,$watermark = '0',$ext = 'gif|jpg|jpeg|bmp|png', $absurl = '', $basehref = '')
	{

// 此处增加类型的判断
        if($ext !== 'gif|jpg|jpeg|bmp|png'){
            if(!in_array(strtoupper($ext),array('JPG','GIF','BMP','PNG','JPEG'))) exit('附加扩展名必须为gif、jpg、jpeg、bmp、png');
        }

        global $image_d;
		$this->att_db = pc_base::load_model('attachment_model');
		$upload_url = pc_base::load_config('system','upload_url');
		$this->field = $field;

作者
分类 网站建设

评论

本文评论功能已关闭。

← 较早的 较新的 →