Ubungozi ku-MyBB obukuvumela ukuthi ubambe ukulawula kwenkundla

Enjinini yokwakha izinkundla zewebhu I-MyBB eziningana ubuthakathaka, okukuvumela ukuthi uhlele ukuhlasela kwezigaba eziningi ukuze wenze ikhodi ye-PHP engafanele kuseva. Izinkinga zilungisiwe ekukhululweni I-MyBB 1.8.21.

Ukuba sengozini kokuqala kukhona kumamojula okushicilela nokuthumela imilayezo eyimfihlo, futhi kuvumela ukushintshwa kwekhodi ye-JavaScript (XSS), ezosetshenziswa esipheqululini uma ubuka okushicilelwe noma umlayezo owamukelwe. Ukushintsha i-JavaScript kungenzeka ngenxa yokuguqulwa okungalungile kwama-BCodes ashumekiwe abe yi-HTML. Ikakhulukazi, ithegi
«

futhi lapho kucutshungulwa i-BBCode "" izoguqulwa ibe umaka

‹iframe src=»youtube.com/xyz[url]http://onload=evilCode()[/url]»›‹/iframe›

, futhi ngemva kokucubungula ama-BCodes asele ku

‹iframe src=»youtube.com/xyz‹a href=»http://onload=evilCode()»›..»›‹/iframe›

Ngokufanelekile, ukucaphuna okukabili kokuthi 'href="' kuvala isibaluli se-"src" futhi i-OnLoad icutshungulwa kumongo we-iframe.

Ukuba sengozini kwesibili kuvumela, uma unamalungelo omphathi wenkundla, ukuthi ulondoloze umbhalo we-PHP ohlelweni lwefayela leseva yewebhu futhi uhlele ukusebenza kwawo. Inkinga ikukhodi yokuphatha isitayela yetimu esebenzayo, evumela ukuthi amafayela e-CSS amasha enziwe. Amafayela anjalo alondolozwa ngokwengezwa kwesandiso se-“.css”, kodwa ubukhulu benkambu kusizindalwazi esinegama lefayela bukhawulelwe ezinhlamvu ezingu-30. Ngokufanelekile, ungaqamba ifayela elithi “26characters.php.css”. Lapho ubhalela kusizindalwazi, izinhlamvu ezengeziwe zizonqanyulwa futhi ekugcineni igama elithi “26characters.php” lizogcinwa. Okulandelayo, ngephaneli yomqondisi wenkundla, ungakha isitayela esisha futhi ifayela lizobhalwa kumkhombandlela "wenqolobane" ngesandiso sephp.

Ukuze enze ukuhlasela, umhlaseli angathumela umlayezo oklanywe ngokukhethekile kumphathi wenkundla noma ashicilele umlayezo ofanayo esithangamini. Uma ubuka lo mlayezo esipheqululini njengengxenye yeseshini yamanje kuforamu kanye namalungelo omsebenzisi obuka umlayezo, ikhodi ye-JavaScript ecaciswe umhlaseli izosetshenziswa. Uma umlayezo ubukwa umlawuli, kuba sengozini kwesibili kusetshenziswa ikhodi ye-PHP kumongo weseshini enelungelo.

Source: opennet.ru