## 前言

这段时间在搞代码审计，想挖个CVE出来。于是选择了GeniXCMS,开始了我的审计之旅。
经过近一周的时间，也算是搞到了一些漏洞，都是一些简单的洞，但通过组合依旧可以getshell：
This time in the code audit, would like to dig a CVE out. So chose GeniXCMS, started my audit tour.
After nearly a week's time, can be considered to get some loopholes, are some simple holes, but still can be combined by the collectionhellhell:

## 漏洞一：后台反射型XSS
### 漏洞原理：
在/inc/lib/backend/menus.control.php的117行，判断是否存在$_GET['id']；若存在，则赋值给$menuid；而前台有很多直接输出$menuid的；
### 漏洞复现：
http://127.0.0.1/geniXCMS_new/gxadmin/index.php?page=menus&id=%22%20onclick=%22alert(1)%22
![](http://ovc0f0a85.bkt.clouddn.com/5djfqx25lomt2c8z3o0y0ewylo.png)

## Loophole One: Background Reflective XSS
Loopholes
In the /inc/lib/backend/menus.control.php 117 lines to determine whether there is $ _GET ['id']; if there is, then assigned to $ menuid; and the front there are many direct output $ menuid;
Vulnerability:
http://gu_us
![](http://ovc0f0a85.bkt.clouddn.com/5djfqx25lomt2c8z3o0y0ewylo.png)

## 漏洞二：储存型XSS
### 漏洞原理：
在/inc/lib/Control/Backend/menus.control.php第99行
![](http://ovc0f0a85.bkt.clouddn.com/qyul53y1a0mgqe6w5v0o02a84z.png)
获取了id数据后直接插入进了数据库，没有进行XSS的过滤
在gxadmin/inc/menus_form.php的第22行
![](http://ovc0f0a85.bkt.clouddn.com/fy0o19cfa5szik3i9r73qa7hhy.png)
直接从数据库中调取了menuid，没有进行HTML实体编码的处理
然后在该页面的第77行
![](http://ovc0f0a85.bkt.clouddn.com/iixmkx7rsozjjftor18y83t052.png)
直接输出了menuid
### 漏洞复现：
在http://127.0.0.1/GeniXCMS_new/gxadmin/index.php?page=menus页面，点击又上角的Add Menu，然后在新添加的menu栏
http://127.0.0.1/GeniXCMS_new/gxadmin/index.php?page=menus页面，点击
![](http://ovc0f0a85.bkt.clouddn.com/enrl0c8wwhveueyyi3iea5ocx4.png)
填写基本的Menu Name以及Menu Type之后，提交并使用BurpSuite抓包，然后修改id值为我们的攻击代码
" onclik="alert(1)"
![](http://ovc0f0a85.bkt.clouddn.com/uic0ecoi5a9bp1zj5bn7s6hjpd.png)
在数据库管理后台就可以发现
![](http://ovc0f0a85.bkt.clouddn.com/jwqu2j5w5mwy7ie02ppimgdmfg.png)
已经插入了我们的攻击代码
然后点击编辑页面
![](http://ovc0f0a85.bkt.clouddn.com/xmssop259hql4nywutqhdr6omk.png)
将id参数删去，并修改itemid为包含攻击代码的一栏
![](http://ovc0f0a85.bkt.clouddn.com/xx4te5ow13cpildzqnignaqest.png)
就可以成功弹窗

## Vulnerability II: Storage XSS 
Loopholes
In /inc/lib/Control/Backend/menus.control.php line 99.
![](http://ovc0f0a85.bkt.clouddn.com/qyul53y1a0mgqe6w5v0o02a84z.png)
Get the id data directly inserted into the database, no XSS filtering
In line 2 of gxadmin / inc / menus_form.php
![](http://ovc0f0a85.bkt.clouddn.com/fy0o19cfa5szik3i9r73qa7hhy.png)
Directly from the database to retrieve the menuid, no HTML entity encoding processing
Then on line 77 of the page
![](http://ovc0f0a85.bkt.clouddn.com/iixmkx7rsozjjftor18y83t052.png)
Directly output menuid
Vulnerability:
On the http://127.0.0.1/GeniXCMS_new/gxadmin/index.php?page=menus page, click the Add Menu in the upper corner and click on the newly added menu bar
http://127.0.0.1/GeniXCMS_new/gxadmin/index.php?page=menus page, click
![](http://ovc0f0a85.bkt.clouddn.com/enrl0c8wwhveueyyi3iea5ocx4.png)
Fill in the basic Menu Name and Menu Type, submit and use BurpSuite capturing packets, and then modify the id value for our attack code
"onclik =" alert (1) "
![](http://ovc0f0a85.bkt.clouddn.com/uic0ecoi5a9bp1zj5bn7s6hjpd.png)
In the database management background can be found
![](http://ovc0f0a85.bkt.clouddn.com/jwqu2j5w5mwy7ie02ppimgdmfg.png)
Has inserted our attack code
Then click Edit Page
![](http://ovc0f0a85.bkt.clouddn.com/xmssop259hql4nywutqhdr6omk.png)
Delete the id parameter and modify itemid as the column containing the attack code
![](http://ovc0f0a85.bkt.clouddn.com/xx4te5ow13cpildzqnignaqest.png)
You can successfully play the window

## 漏洞三：储存型XSS
### 漏洞复现：
在http://127.0.0.1/geniXCMS_new/gxadmin/index.php?page=menus处点击 Add Menu
在Menuid处，输入攻击代码
![](http://ovc0f0a85.bkt.clouddn.com/6a62ftoi0no5se0zhaozicfsky.png)
在点击该栏时会成功触发
![](http://ovc0f0a85.bkt.clouddn.com/eqhv1o520bnbfd93bzgd701itf.png)
这个menuid并没有储存在数据库，猜测为前端的一些设置导致了储存型XSS

## Vulnerability Three: Storage Type XSS
Vulnerability:
Click Add Menu at http://127.0.0.1/geniXCMS_new/gxadmin/index.php?page=menus
At the Menuid, enter the attack code
![](http://ovc0f0a85.bkt.clouddn.com/6a62ftoi0no5se0zhaozicfsky.png)
Will be triggered when you click on the column
![](http://ovc0f0a85.bkt.clouddn.com/eqhv1o520bnbfd93bzgd701itf.png)
The menuid is not stored in the database, guess some of the front-end settings led to the storage XSS

## 漏洞四：上传主题文件，远程代码执行
在Themes设置页面，GeniXCMS会自动解压上传上去的zip文件，但却没有检测里面是否为php文件。
![](http://ovc0f0a85.bkt.clouddn.com/uo81yk3k8g8sq0okcukw0ln6u5.png)
直接自动解压，并没有拦截压缩包里的php文件。
可以写入一句话木马，远程代码执行

![](http://ovc0f0a85.bkt.clouddn.com/xf9cvsu6cbxrbplvj071lwb138.png)
![](http://ovc0f0a85.bkt.clouddn.com/51ctfyi6647viyhcmd5mlexsi3.png)
应该检测解压后的文件类型，并禁止储存php等危害性高的文件。

## Vulnerability IV: Upload the theme file ，Remote code execution.
In the Themes settings page, GeniXCMS will automatically extract the upload up the zip file, but did not detect whether it is php file.
![](http://ovc0f0a85.bkt.clouddn.com/uo81yk3k8g8sq0okcukw0ln6u5.png)
Direct automatic decompression, and did not intercept the compressed file in the php file
Can write a word Trojan, remote code execution

![](http://ovc0f0a85.bkt.clouddn.com/xf9cvsu6cbxrbplvj071lwb138.png)
![](http://ovc0f0a85.bkt.clouddn.com/51ctfyi6647viyhcmd5mlexsi3.png)
Should be detected after decompression of the file type, and prohibit the storage of php and other high-risk files.


## 漏洞五：上传模板文件，远程代码执行
在Modules设置页面，GeniXCMS会自动解压上传上去的zip文件，但却没有检测里面是否为php文件。
![](http://ovc0f0a85.bkt.clouddn.com/c41m1x1n4j84z871cbo3ck888h.png)
直接自动解压，并没有拦截压缩包里的php文件
![](http://ovc0f0a85.bkt.clouddn.com/jps7r1p2dnu0iiw9vm448lvvd9.png)
![](http://ovc0f0a85.bkt.clouddn.com/51ctfyi6647viyhcmd5mlexsi3.png)
在WWW\GeniXCMS_new\inc\mod下可以找到上传的木马，可以写入一句话木马，远程代码执行

## Vulnerability Five: Upload template file，Remote code execution.
In the Modules settings page, GeniXCMS will automatically extract the upload up the zip file, but did not detect whether the php file.
![](http://ovc0f0a85.bkt.clouddn.com/c41m1x1n4j84z871cbo3ck888h.png)
Direct automatic decompression, and did not intercept the compressed file in the php file
Can write a word Trojan, remote code execution

![](http://ovc0f0a85.bkt.clouddn.com/jps7r1p2dnu0iiw9vm448lvvd9.png)
![](http://ovc0f0a85.bkt.clouddn.com/51ctfyi6647viyhcmd5mlexsi3.png)
In the WWW \ GeniXCMS_new \ inc \ mod can be found under the upload Trojan。
Can write a word Trojan, remote code execution

## 总结：
都是一些很简单的漏洞，希望以后能像Phithon师傅一样，审到一些深层的东西。
## Summary:
are some very simple loopholes, hope to be like Phithon master, like to review some deep things.