Ukuba semngciphekweni kwiMyBB okukuvumela ukuba uthabathe ulawulo lweforamu

Kwi-injini yokudala iiforum zewebhu MyBB ezininzi ubuthathaka, ikuvumela ukuba uququzelele uhlaselo lwamanqanaba amaninzi ukwenza ikhowudi ye-PHP engafanelekanga kumncedisi. Imiba ilungisiwe ekukhululweni I-MyBB 1.8.21.

Ubuthathaka bokuqala bukhona kwiimodyuli zokupapasha kunye nokuthumela imiyalezo yangasese, kwaye ivumela ukutshintshwa kwekhowudi yeJavaScript (XSS), eya kwenziwa kwisiphequluli xa ujonga ukupapashwa okanye umyalezo ofunyenweyo. JavaScript substitution iyenzeka ngenxa yoguqulo olungachanekanga lwe-BBCodes enendlwane ukuya kwiHTML. Ngokukodwa, ithegi
«

kwaye xa kusetyenzwa iBBCode "" iya kuguqulwa ibe yithegi

‹iframe src=»youtube.com/xyz[url]http://onload=evilCode()[/url]»›‹/iframe›

, kwaye emva kokucubungula i-BBCodes eseleyo kwi

‹iframe src=»youtube.com/xyz‹a href=»http://onload=evilCode()»›..»»‹/iframe›

Ngokufanelekileyo, isicatshulwa esiphindwe kabini kwi-'href="' sivala uphawu lwe-"src" kwaye i-OnLoad iqhubekekiswa kumxholo we-iframe.

Ubuthathaka besibini buvumela, ukuba unamalungelo omlawuli weforum, ukugcina iskripthi se-PHP kwinkqubo yefayile yomncedisi wewebhu kwaye uququzelele ukuphunyezwa kwayo. Ingxaki ikwikhowudi yolawulo lwesitayela somxholo osebenzayo, ovumela ukuba kuveliswe iifayile zeCSS ezintsha. Iifayile ezinjalo zigcinwa kunye nokongezwa kwesandiso ".css", kodwa ubungakanani bentsimi kwisiseko sedatha kunye negama lefayile lilinganiselwe kwiimpawu ze-30. Ngokufanelekileyo, ungabiza ifayile "26characters.php.css". Xa ubhala kwi-database, abalinganiswa abongezelelweyo baya kunqunyulwa kwaye ekugqibeleni igama elithi "26characters.php" liya kugcinwa. Okulandelayo, ngephaneli yolawulo yeforum, unokuvelisa isitayile esitsha kwaye ifayile iya kubhalwa kwi "cache" directory kunye nolwandiso lwephp.

Ukwenza uhlaselo, umhlaseli unokuthumela umyalezo olungiselelwe ngokukodwa kumlawuli weforum okanye apapashe umyalezo ofanayo kwiforum. Xa ujonga lo myalezo kwisikhangeli njengenxalenye yeseshoni yangoku kwiforum kunye namalungelo omsebenzisi ojonga umyalezo, ikhowudi yeJavaScript echazwe ngumhlaseli iya kuphunyezwa. Ukuba umyalezo ujongwe ngumlawuli, ubuthathaka besibini busetyenziswa ukwenza ikhowudi ye-PHP kumxholo weseshoni enelungelo.

umthombo: opennet.ru