我刚刚收到一个网站来管理,但是我不太清楚上一个人写的代码.我正在粘贴下面的登录过程,你可以看看,告诉我有没有安全漏洞?乍看起来,似乎可以通过sql注入或操纵cookie和?m =参数进入.
define ( 'CURRENT_TIME',time ()); / / Current time. define ( 'ONLINE_TIME_MIN',(CURRENT_TIME - BOTNET_TIMEOUT)); / / Minimum time for the status of "Online". define ( 'DEFAULT_LANGUAGE','en'); / / Default language. define ( 'THEME_PATH','theme'); / / folder for the theme. / / HTTP requests. define ( 'QUERY_SCRIPT',basename ($_SERVER [ 'PHP_SELF'])); define ( 'QUERY_SCRIPT_HTML',QUERY_SCRIPT); define ( 'QUERY_VAR_MODULE','m'); / / variable contains the current module. define ( 'QUERY_STRING_BLANK',QUERY_SCRIPT. '? m ='); / / An empty query string. define ( 'QUERY_STRING_BLANK_HTML',QUERY_SCRIPT_HTML. '? m ='); / / Empty query string in HTML. define ( 'CP_HTTP_ROOT',str_replace ( '\ \','/',(! empty ($_SERVER [ 'SCRIPT_NAME'])? dirname ($_SERVER [ 'SCRIPT_NAME']):'/'))); / / root of CP. / / The session cookie. define ( 'COOKIE_USER','p'); / / Username in the cookies. define ( 'COOKIE_PASS','u'); / / user password in the cookies. define ( 'COOKIE_LIVETIME',CURRENT_TIME + 2592000) / / Lifetime cookies. define ( 'COOKIE_SESSION','ref'); / / variable to store the session. define ( 'SESSION_LIVETIME',CURRENT_TIME + 1300) / / Lifetime of the session. ////////////////////////////////////////////////// ///////////////////////////// / / Initialize. ////////////////////////////////////////////////// ///////////////////////////// / / Connect to the database. if (! ConnectToDB ()) die (MysqL_error_ex ()); / / Connecting topic. require_once (THEME_PATH. '/ index.PHP'); / / Manage login. if (! empty ($_GET [QUERY_VAR_MODULE])) ( / / Login form. if (strcmp ($_GET [QUERY_VAR_MODULE],'login') === 0) ( UnlockSessionAndDestroyAllCokies (); if (isset ($_POST [ 'user']) & & isset ($_POST [ 'pass'])) ( $user = $_POST [ 'user']; $pass = md5 ($_POST [ 'pass']); / / Check login. if (@ MysqL_query ( "SELECT id FROM cp_users WHERE name = '". addslashes ($user). "' AND pass = '". addslashes ($pass). "' AND flag_enabled = '1 'LIMIT 1") & & @ MysqL_affected_rows () == 1) ( if (isset ($_POST [ 'remember']) & & $_POST [ 'remember'] == 1) ( setcookie (COOKIE_USER,md5 ($user),COOKIE_LIVETIME,CP_HTTP_ROOT); setcookie (COOKIE_PASS,$pass,CP_HTTP_ROOT); ) LockSession (); $_SESSION [ 'Name'] = $user; $_SESSION [ 'Pass'] = $pass; / / UnlockSession (); header ( 'Location:'. QUERY_STRING_BLANK. 'home'); ) else ShowLoginForm (true); die (); ) ShowLoginForm (false); die (); ) / / Output if (strcmp ($_GET [ 'm'],'logout') === 0) ( UnlockSessionAndDestroyAllCokies (); header ( 'Location:'. QUERY_STRING_BLANK. 'login'); die (); ) ) ////////////////////////////////////////////////// ///////////////////////////// / / Check the login data. ////////////////////////////////////////////////// ///////////////////////////// $logined = 0,/ / flag means,we zalogininy. / / Log in session. LockSession (); if (! empty ($_SESSION [ 'name']) & &! empty ($_SESSION [ 'pass'])) ( if (($r = @ MysqL_query ( "SELECT * FROM cp_users WHERE name = '". addslashes ($_SESSION [' name'])."' AND pass = ' ". addslashes ($_SESSION [' pass']). " 'AND flag_enabled = '1' LIMIT 1 ")))$logined = @ MysqL_affected_rows (); ) / / Login through cookies. if ($logined! == 1 & &! empty ($_COOKIE [COOKIE_USER]) & &! empty ($_COOKIE [COOKIE_PASS])) ( if (($r = @ MysqL_query ( "SELECT * FROM cp_users WHERE MD5 (name )='". addslashes ($_COOKIE [COOKIE_USER ])."' AND pass = '". addslashes ($_COOKIE [COOKIE_PASS]). " 'AND flag_enabled = '1' LIMIT 1 ")))$logined = @ MysqL_affected_rows (); ) / / Unable to login. if ($logined! == 1) ( UnlockSessionAndDestroyAllCokies (); header ( 'Location:'. QUERY_STRING_BLANK. 'login'); die (); ) / / Get the user data. $_USER_DATA = @ MysqL_fetch_assoc ($r); if ($_USER_DATA === false) die (MysqL_error_ex ()); $_SESSION [ 'Name'] = $_USER_DATA [ 'name']; $_SESSION [ 'Pass'] = $_USER_DATA [ 'pass']; / / Connecting language. if (@ strlen ($_USER_DATA [ 'language'])! = 2 | |! SafePath ($_USER_DATA [ 'language']) | |! file_exists ( 'system / lng .'.$_ USER_DATA [' language '].' . PHP'))$_ USER_DATA [ 'language'] = DEFAULT_LANGUAGE; require_once ( 'system / lng .'.$_ USER_DATA [' language'].'. PHP '); UnlockSession ();
是的,这段代码有一些漏洞.
原文链接:https://www.f2er.com/php/132642.html这可能是一个问题:
define ( 'QUERY_SCRIPT',basename ($_SERVER [ 'PHP_SELF']));
PHP_SELF是坏的,因为攻击者可以控制这个变量.例如,当您使用此URL访问脚本时尝试打印PHP_SELF:http://localhost/index.PHP/test/junk/hacked.尽可能避免使用此变量,如果您使用它,请确保对其进行消毒.在使用此变量时看到XSS出现是非常常见的.
第一漏洞:
setcookie (COOKIE_USER,CP_HTTP_ROOT); setcookie (COOKIE_PASS,CP_HTTP_ROOT);
这是一个相当严重的漏洞.如果攻击者在您的应用程序中注入sql,那么他们可以立即获取md5哈希和用户名,并立即登录,而不必打破md5()哈希.就好像你用明文存储密码一样.
这个会话漏洞是两倍,它也是一个“不朽的会话”,Session id必须始终是大的随机生成的值到期.如果他们不到期,那么他们更容易暴力.
您应该永远不要重新发明轮子,在应用程序开始时调用session_start(),这将自动生成一个到期的安全会话ID.然后使用$_SESSION [‘user’]之类的会话变量来跟踪浏览器是否实际登录.
第二个漏洞:
$pass = md5 ($_POST [ 'pass']);
md5()被证明是不安全的,因为有意产生冲突. md5()不应该用于密码.您应该使用sha2系列的成员,sha-256或sha-512是很好的选择.
第3漏洞:
我没有看到任何CSRF保护您的身份验证逻辑.我怀疑您应用中的所有请求都容易受到CSRF的影响.