xhcms审计复现

1.index.php(file存在文件包含，addslash无法防文件包含)

函数

addslash(单双引号反斜杠NULL前加\)

语句

$file=addslashes($_GET['r']); //接收文件名 $action=$file==''?'index':$file; //判断为空或者等于index include('files/'.$action.'.php'); //载入相应文件

2.inc/checklogin.php(cookie伪造登录)

语句

<?php $user=$_COOKIE['user']; if ($user==""){ header("Location: ?r=login"); exit; } ?>

3.admin/files/wzlist.php(csrf-文章删除)

语句

$delete=$_GET['delete']; if ($delete<>""){ $query = "DELETE FROM content WHERE id='$delete'";

4.admin/files/editlink.php(id参数sql注入)

语句

$id=$_GET['id']; $type=$_GET['type']; if ($type==1){ $query = "SELECT * FROM nav WHERE id='$id'";

5.files/download.php(id参数sql注入)

语句

$query = "SELECT * FROM nav WHERE link='$llink'";

6.admin/files/login.php(user参数存在sql注入)

语句

$user=$_POST['user']; $query = "SELECT * FROM manage WHERE user='$user'";

7. file/contact.php(xss)

语句

$page=addslashes($_GET['page']);

<?php echo $page?>

8.files/contents.php(多个xss)

语句

<li>昵称<input name="name" type="text" value="<?php echo $_COOKIE['name']?>" /></li> <li>邮箱<input name="mail" type="text" value="<?php echo $_COOKIE['mail']?>"/></li> <li>网址<input name="url" type="text" value="<?php echo $_COOKIE['url']?>"/></li>

9.admin/files/commentlist.php(title参数xss)

语句

$fl_id=$list['cid']; $query1 = "SELECT * FROM $biao WHERE id='$fl_id'"; $resul1 = mysql_query($query1) or die('SQL语句有误：'.mysql_error()); $contentname = mysql_fetch_array($resul1);

<td><?php echo $contentname ['title'];?></td>