乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2012-08-27: 积极联系厂商并且等待厂商认领中,细节不对外公开 2012-10-11: 厂商已经主动忽略漏洞,细节向公众公开
此程序多用于网络媒体各大地方卫视,程序目录dealfunc下comment_stat.php和comment_js.php,对cmid未做过滤。直接导致注射。后台默认地址为 http://cp.xxxx.com/ws
comment_stat.php文件源码
<?php /*** comment_stat.php :: 评论回复统计文件 :: dealfunc* * $Id: comment_stat.php 67 2007-06-01 03:48:20Z $*/define ('INCLUDE_PATH', './../');require_once "./../liv_global.php";$staticfile = $_REQUEST['staticfile'];$commresult = $DB->query_first("SELECT count(*) as cmtnum FROM liv_comment where contentid=".$_REQUEST['cmid'] . " and auditing=1 ");?>document.write('<?php echo intval($commresult['cmtnum']);?>');<?php?>comment_js.php文件源码<?php /*** comment_js.php :: 评论JS调用 :: dealfunc* * $Id: comment_js.php 67 2007-06-01 03:48:20Z $*/define('INCLUDE_PATH','./../');require "./../liv_global.php";$cmid = $_REQUEST['cmid'];if ($cmid){$cond = ' AND contentid=' . $cmid;}$limit = intval($_REQUEST['limit']) ? intval($_REQUEST['limit']) : 6;$brieflength = intval($_REQUEST['brieflength']) ? intval($_REQUEST['brieflength']) : 100;?> document.write('<ul style="border-bottom:1px solid #ccc;margin-bottom:10px;"><li style="font-size:14px;font-weight:bold;">文章评论:</li>');<?php$result = $DB->query("SELECT * FROM " . DB_PREFIX . "comment WHERE auditing = 1 and siteid = " . intval($siteinfo['siteid']) . $cond . " ORDER BY pubdate DESC LIMIT $limit");//echo "SELECT * FROM " . DB_PREFIX . "comment WHERE auditing = 1 and siteid = " . intval($siteinfo['siteid']) . $cond . " and contentid=".$cmid." ORDER BY pubdate DESC LIMIT $limit";$rst = $DB->num_rows($result);//$commentlink = $siteinfo['sitepath'].'comment/comment.php?cmid='.$cmid.'&modeid='.$modeid;$commentlink = $siteinfo['sitepath'].'comment/comment.php?cmid='.$cmid;while($row = $DB->fetch_array($result)){ $content = cutchars($row['content'],$brieflength); // $content = nl2br($content); $content = str_replace(array(chr(10),chr(13)),"",$content); $pubdate = date('Y-m-d',$row['pubdate']); $author = $row['author']; $ips = explode(".",$row['ip']); $newip = $ips[0].'.'.$ips[1].'.*.*'; $link = $siteinfo['weburl'] . 'comment/comment.php?cmid=' . $row['contentid']; ?> document.write('<li style="background:#f1f1f1;border-bottom:1px solid #d8d8d8;padding:5px;">网友:<b><?php echo $author ?></b> 时间:<?php echo $pubdate ?> IP:<?php echo $newip ?></li><li style="line-height:22px;padding:5px;"><a href="<?php echo $link ?>" target="_blank"><?php echo $content;?></a></li>'); <?php}if($rst != 0){ ?> document.write('<li style="text-align:right;line-height:22px;font-weight:bold;padding-right:10px;"><a href="<?php echo $commentlink ?>" target="_blank">更多留言</a></li>'); <?php}?> document.write('</ul>');<?php?>
没任何过滤,直接带入查询
加强过滤或直接删除此目录下的文件,
未能联系到厂商或者厂商积极拒绝