{"id":199436,"date":"2025-05-03T11:29:29","date_gmt":"2025-05-03T03:29:29","guid":{"rendered":"https:\/\/server.hk\/cnblog\/199436\/"},"modified":"2025-05-03T11:29:29","modified_gmt":"2025-05-03T03:29:29","slug":"%e4%bf%ae%e5%a4%8decshop%e6%b3%a8%e5%85%a5xss%e4%b8%89%e4%b8%aa%e6%bc%8f%e6%b4%9e%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/server.hk\/cnblog\/199436\/","title":{"rendered":"\u4fee\u590decshop\u6ce8\u5165XSS\u4e09\u4e2a\u6f0f\u6d1e\u65b9\u6cd5"},"content":{"rendered":"

Ecshop pages.lbi.php Xss\u6f0f\u6d1e,search.php\u6ce8\u5165\u6f0f\u6d1e,Ecshop version XSS\u6f0f\u6d1e
 <\/p>\n

1.Ecshop pages.lbi.php Xss\u6f0f\u6d1e<\/p>\n

\u5148\u6765\u5206\u6790\u8fd9\u4e2a\u6f0f\u6d1e\u7684\u539f\u56e0\uff1a<\/p>\n

\u76f4\u63a5\u8bbf\u95eetemp\/compiled\/pages.lbi.php\u65f6\uff0c\u6d4f\u89c8\u6e90\u6587\u4ef6\uff0c\u4f1a\u53d1\u73b0\u5982\u4e0b\u4ee3\u7801\uff1a<\/p>\n

<form action=\u201dtemp\/compiled\/pages.lbi.php\u201d method=\u201dget\u201d><\/p>\n

\u663e\u7136\u8fd9\u4e2aform\u662f\u4e0d\u5b8c\u5168\u7684\u3002\u5f53\u6784\u9020\u8fd9\u6837\u7684url\u8bbf\u95ee\u65f6\uff0c\u4f1a\u9020\u6210\u5728\u5ba2\u6237\u7aef\u6267\u884c\u4ee3\u7801\uff1a<\/p>\n

temp\/compiled\/pages.lbi.php\/\u201d<\/form><sCripT>alert(\/cfreer\/)<\/scRipt><\/p>\n

\u5f88\u663e\u7136\uff0c\u8fd9\u4e2a\u6f0f\u6d1e\u7684\u539f\u7406\u5c31\u662f\u95ed\u5408\u4e86\u8fd9\u4e2aform\u518d\u5728\u5ba2\u6237\u7aef\u6267\u884cjavascript.<\/p>\n

\u7136\u540e\u5206\u6790\u51fa\u73b0\u4e0d\u95ed\u5408form\u7684\u539f\u56e0\uff0c\u6253\u5f00page.lbi.php\u6587\u4ef6\uff0c\u53ef\u4ee5\u770b\u5230\u5982\u4e0b\u4ee3\u7801<\/p>\n

<form action=\u201d<?php echo $_SERVER[\u2018PHP_SELF\u2019]; ?>\u201d method=\u201dget\u201d> <?php if ($this->_var[\u2018pager\u2019][\u2018styleid\u2019] == 0): ?><\/p>\n

\u8fd9\u91cc\u6267\u884c$this\u7684\u65f6\u5019\u5c31\u51fa\u73b0\u9519\u8bef\u4e86\uff0c\uff0c\u56e0\u4e3a\u6ca1\u6709\u8fdb\u884ctemplate\u7684\u521d\u59cb\u5316\u3002<\/p>\n

\u65e2\u7136\u627e\u5230\u539f\u56e0\u4e86\uff0c\u4e0b\u9762\u7ed9\u51fa\u89e3\u51b3\u529e\u6cd5\uff1a<\/p>\n

\u6253\u5f00page.lbi\u6587\u4ef6\uff0c\u5728\u7b2c\u4e8c\u884c\u63d2\u5165\u5982\u4e0b\u4ee3\u7801\uff1a<\/p>\n

<?php if (!defined(\u2018IN_ECS\u2019)) { die(\u2018Hacking attempt\u2019); } ?><\/p>\n

 <\/p>\n

2.search.php\u6ce8\u5165\u6f0f\u6d1e<\/p>\n

search.php
\u5927\u6982300 \u6e90
if (is_not_null($val) )
\u4fee\u6539\u4e3a
if (is_not_null($val) && is_numeric($key))
\u5c31\u53ef\u4ee5\u4e86<\/p>\n

 <\/p>\n

3.Ecshop version XSS\u6f0f\u6d1e<\/p>\n

\u6253\u5f00\/admin\/receive.php\u6587\u4ef6\u4e2d\uff0c\u641c\u7d22\u5982\u4e0b\u4ee3\u7801\uff1a<\/p>\n

$version=$_GET[\u2018version\u2019];<\/p>\n

\u4fee\u6539\u4e3a\u5982\u4e0b\u4ee3\u7801\uff1a<\/p>\n

$version=htmlspecialchars($_GET[\u2018version\u2019]);<\/p>\n","protected":false},"excerpt":{"rendered":"

Ecshop pages.lbi...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4925],"tags":[],"class_list":["post-199436","post","type-post","status-publish","format-standard","hentry","category-4925"],"_links":{"self":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts\/199436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/comments?post=199436"}],"version-history":[{"count":0,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts\/199436\/revisions"}],"wp:attachment":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/media?parent=199436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/categories?post=199436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/tags?post=199436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}