Walks

网络安全爱好者

代码审计:Discuz!X 3.4前台任意文件删除漏洞

前言:

学习代码审计中,毕竟不会代码审计的安全人员不是一个好的安全人员。这是我写代码审计的第一篇文章,之前复现了Discuz!X 3.4的任意文件删除,那么我就来写写这个漏洞的成因。这个漏洞在我博客也是可以找到的,所以前面的话也不多说了,直接开始分析吧。

漏洞分析:

这个漏洞的根本原因在于下图的代码

《代码审计:Discuz!X 3.4前台任意文件删除漏洞》

我们可以看到unlink函数后有个$space[$key],这个参数就是我们的个人设置,是从数据库中读取出来的,而从数据库中读取的数据是我们可以前台控制的数据,那么unlink后面的参数是不是就是可以控制的了。

在看别人的分析代码的时候,在这段代码之前也有个unlink,但是给修复了,所以不用管,我们这个这个版本的漏洞的成因就在这。

我们向前回溯一下,看看$space在哪

《代码审计:Discuz!X 3.4前台任意文件删除漏洞》

如图:$space = getuserbyuid($_G['uid']),就是获取uid相对应的用户

space_merge()函数的功能是把$space存入对应的数据表中,但是并无过滤

所以我们可以POST提交,修改个人资料,如下图,资料修改

《代码审计:Discuz!X 3.4前台任意文件删除漏洞》 

space_merge函数把存入数据表,下图birthprovince的数据,这里数据不一致的原因是我截图的时候是又测试了下是否可重装。

《代码审计:Discuz!X 3.4前台任意文件删除漏洞》

在最后,上传图片,满足我们这个漏洞的if语句,就达到了任意文件删除的目的。

点赞
  1. goyard handbags说道:

    My wife and i ended up being very relieved when Jordan could round up his analysis through your precious recommendations he discovered through your weblog. It is now and again perplexing to simply be giving away tips that many other people may have been trying to sell. And we all acknowledge we need the website owner to be grateful to for that. All of the explanations you have made, the simple website menu, the friendships you make it easier to foster - it's got mostly sensational, and it's helping our son in addition to our family feel that the matter is awesome, and that's very mandatory. Thank you for the whole thing!

  2. nike shoes说道:

    I and my pals came checking out the good hints from your website and the sudden got a horrible feeling I had not expressed respect to the site owner for those secrets. Those women became for this reason stimulated to read all of them and have now seriously been tapping into these things. We appreciate you really being so considerate as well as for utilizing some magnificent issues millions of individuals are really desirous to discover. Our honest regret for not saying thanks to earlier.

  3. Thank you so much for providing individuals with an extremely special opportunity to read from this site. It is usually very useful and as well , jam-packed with a good time for me and my office acquaintances to visit your blog minimum thrice weekly to find out the latest secrets you have. And definitely, I am actually contented for the stunning thoughts served by you. Selected 4 areas in this article are completely the best I've ever had.

  4. I intended to draft you the tiny note to help give thanks as before for your personal exceptional pointers you have provided here. This has been simply remarkably open-handed of people like you in giving openly what most of us would have made available for an e-book to get some profit on their own, chiefly now that you might have done it in case you considered necessary. Those advice additionally served like a good way to fully grasp that many people have the identical fervor just like mine to figure out somewhat more regarding this condition. I am sure there are numerous more fun times up front for many who read carefully your blog post.

  5. I want to show appreciation to this writer just for bailing me out of this incident. As a result of checking through the world-wide-web and getting recommendations which are not pleasant, I assumed my life was gone. Living without the presence of answers to the difficulties you've fixed through this posting is a serious case, and ones which might have adversely affected my career if I had not discovered your web site. Your personal mastery and kindness in maneuvering all the stuff was crucial. I'm not sure what I would have done if I hadn't encountered such a solution like this. I can also at this moment look ahead to my future. Thanks for your time so much for the high quality and amazing guide. I will not hesitate to suggest your web sites to any person who should receive support on this issue.

  6. hyperdunks说道:

    A lot of thanks for all your valuable effort on this web page. My aunt takes pleasure in working on internet research and it's really obvious why. We all learn all of the lively form you deliver great guidelines through the website and even welcome contribution from the others about this area of interest then our simple princess is always studying a lot of things. Take pleasure in the remaining portion of the new year. You're doing a superb job.

  7. I want to point out my respect for your kindness in support of visitors who must have assistance with your matter. Your personal dedication to getting the solution throughout appears to be wonderfully good and has frequently encouraged many people just like me to arrive at their dreams. Your useful help and advice entails much to me and even further to my fellow workers. With thanks; from everyone of us.

  8. Needed to compose you this little bit of remark in order to thank you very much yet again relating to the breathtaking thoughts you've shown here. This has been really remarkably generous of you to deliver unhampered what exactly many of us could have offered as an e book to help with making some cash for their own end, particularly seeing that you might have tried it in the event you decided. Those advice also acted to be a easy way to fully grasp that other people have a similar fervor like my own to find out way more on the subject of this problem. I believe there are some more enjoyable instances up front for many who look over your blog post.

  9. stephen curry 5说道:

    I wish to show some thanks to the writer just for rescuing me from this type of condition. Because of researching throughout the world wide web and seeing recommendations that were not powerful, I believed my life was over. Living minus the strategies to the issues you have solved by way of your posting is a serious case, as well as ones that might have in a negative way damaged my career if I had not discovered your site. Your own training and kindness in taking care of the whole lot was valuable. I am not sure what I would have done if I hadn't discovered such a stuff like this. I am able to at this time relish my future. Thanks very much for the impressive and result oriented guide. I will not hesitate to recommend your blog to anybody who would like support about this matter.

  10. balenciaga说道:

    I needed to put you a very little observation to be able to say thanks over again with the extraordinary pointers you've contributed in this case. It is really seriously generous with people like you to make publicly just what most of us could have offered for sale for an electronic book to help with making some money on their own, especially considering the fact that you might well have tried it in case you decided. These pointers additionally served like the good way to fully grasp other people online have the identical passion like my personal own to understand great deal more with respect to this issue. I'm sure there are many more enjoyable sessions in the future for individuals who scan your site.

  11. kobe shoes说道:

    I simply wanted to construct a remark in order to thank you for some of the superb ways you are showing here. My considerable internet lookup has finally been honored with awesome concept to share with my family and friends. I would declare that many of us readers actually are undoubtedly fortunate to exist in a great network with very many marvellous individuals with great pointers. I feel pretty lucky to have used your weblog and look forward to many more cool minutes reading here. Thank you once again for everything.

  12. I wish to point out my respect for your kind-heartedness giving support to those people who really want guidance on this one concept. Your personal commitment to getting the message up and down came to be particularly interesting and has constantly encouraged girls just like me to realize their dreams. Your informative report means much to me and much more to my fellow workers. Regards; from everyone of us.

  13. yeezy boost 700说道:

    I definitely wanted to construct a small comment to be able to thank you for the amazing points you are showing here. My time consuming internet search has finally been honored with reasonable points to exchange with my great friends. I 'd express that we site visitors are very fortunate to dwell in a superb network with many marvellous individuals with very beneficial plans. I feel quite lucky to have encountered your weblog and look forward to many more entertaining moments reading here. Thanks once more for everything.

  14. kobe 11说道:

    My husband and i felt absolutely thrilled Jordan could complete his analysis via the ideas he received out of your web site. It is now and again perplexing just to choose to be offering secrets and techniques which often some other people may have been trying to sell. And we also fully grasp we need you to be grateful to for this. The main illustrations you made, the straightforward website navigation, the friendships you help foster - it's got most sensational, and it is helping our son in addition to our family feel that this matter is satisfying, and that is especially serious. Thanks for the whole lot!

  15. jordan retro说道:

    My husband and i got quite delighted Peter managed to complete his preliminary research using the ideas he came across out of the blog. It is now and again perplexing to simply possibly be giving out tips and hints that people today have been trying to sell. Therefore we figure out we've got the blog owner to be grateful to for this. All of the illustrations you have made, the simple blog navigation, the relationships your site make it possible to engender - it's got mostly impressive, and it's aiding our son in addition to our family recognize that that subject is excellent, and that's very essential. Thank you for everything!

  16. My husband and i ended up being so contented when Edward could deal with his homework because of the precious recommendations he grabbed out of your web pages. It is now and again perplexing to simply possibly be offering guidance that a number of people may have been trying to sell. And we take into account we have the blog owner to be grateful to for this. The most important illustrations you made, the straightforward website menu, the relationships you will aid to foster - it is many spectacular, and it's really assisting our son and us imagine that the theme is exciting, and that's incredibly fundamental. Thanks for the whole lot!

  17. I intended to post you this little observation to be able to say thanks again for these spectacular information you've contributed at this time. This is simply seriously generous of you to provide unhampered what exactly a few individuals could have sold as an e-book in making some cash for themselves, and in particular now that you might have tried it if you desired. These solutions additionally served to be a great way to know that other individuals have similar eagerness much like my own to find out lots more with regards to this condition. I am sure there are several more pleasurable periods in the future for individuals that start reading your site.

  18. off white说道:

    I and my friends ended up looking through the excellent hints on the website and immediately got a terrible feeling I had not thanked the site owner for those techniques. Those women are actually certainly excited to read through them and already have really been taking advantage of those things. Thanks for genuinely very helpful as well as for choosing certain marvelous areas most people are really wanting to be informed on. My honest regret for not expressing gratitude to you sooner.

  19. nike polo shirts说道:

    I not to mention my pals have already been reading through the best solutions on your website and so all of a sudden got an awful feeling I never thanked the web blog owner for those secrets. All the boys became certainly passionate to read through all of them and have now actually been taking advantage of them. Many thanks for genuinely well kind and also for choosing this kind of exceptional themes most people are really needing to learn about. Our own sincere apologies for not saying thanks to sooner.

  20. hermes belt说道:

    Needed to put you this tiny remark to say thank you the moment again regarding the striking techniques you have provided in this case. It was remarkably open-handed with you to make without restraint what exactly some people would've marketed as an ebook in order to make some bucks for themselves, and in particular seeing that you might have tried it in case you desired. The strategies likewise acted to become a good way to fully grasp that other individuals have similar dreams much like mine to see lots more pertaining to this condition. Certainly there are lots of more pleasant times in the future for those who take a look at your blog post.

  21. I'm writing to let you know what a remarkable experience my cousin's child experienced studying your webblog. She came to understand such a lot of details, not to mention what it is like to possess an excellent helping nature to have the mediocre ones without problems comprehend certain tortuous topics. You really exceeded our own expectations. Thanks for giving such informative, dependable, revealing and unique thoughts on the topic to Kate.

  22. yeezy boost说道:

    I have to show my appreciation to you for bailing me out of this type of setting. As a result of looking out through the the net and seeing recommendations that were not beneficial, I believed my entire life was over. Being alive without the answers to the issues you've fixed by means of the post is a crucial case, as well as the ones which could have negatively damaged my entire career if I had not encountered your web blog. Your own personal understanding and kindness in maneuvering every aspect was tremendous. I don't know what I would've done if I had not come upon such a solution like this. I can at this moment look ahead to my future. Thanks for your time very much for this expert and sensible help. I won't be reluctant to suggest your web page to anyone who would need direction on this subject.

  23. My spouse and i were now peaceful when Louis managed to conclude his homework from the precious recommendations he received from your very own blog. It's not at all simplistic to simply find yourself freely giving tactics which often men and women could have been trying to sell. We really fully grasp we have the website owner to be grateful to because of that. These illustrations you have made, the simple site navigation, the relationships you will help engender - it is many spectacular, and it's helping our son and our family consider that that article is thrilling, and that's truly fundamental. Thanks for all!

  24. curry 4说道:

    I simply wanted to write down a comment in order to appreciate you for all of the fabulous advice you are sharing on this website. My extended internet research has at the end of the day been paid with excellent points to write about with my friends. I 'd state that that most of us website visitors are undoubtedly endowed to be in a useful website with very many wonderful professionals with helpful techniques. I feel really lucky to have seen the site and look forward to some more excellent minutes reading here. Thank you once more for everything.

  25. I would like to convey my respect for your generosity giving support to men and women that require guidance on that matter. Your real dedication to getting the message around appeared to be wonderfully effective and has usually empowered ladies like me to reach their pursuits. Your personal warm and helpful suggestions indicates a whole lot a person like me and somewhat more to my colleagues. Best wishes; from all of us.

发表评论

电子邮件地址不会被公开。 必填项已用*标注