服务器端请求伪造

error/data/prvd/src/sink/ssrf/001-curl_exec.php in curl_execphp

DEDECMS-Q

解决

忽略

链接问题跟踪器

172.17.0.1

ID: 7cmrl5osvgfpv21l4dvc549qin

Unknown Browser

php

版本： 7.2.9

消息

服务器端请求伪造

Stacktrace(最近的调用最先显示)

全部原始数据

/data/prvd/src/sink/ssrf/001-curl_exec.php in curl_exec at line 7
3. function curl_exec($ch) {
4. // $url 并没有被 mark 上
5. $url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
6. prvd_check_ssrf($url, prvd_translate("Server Side Request Forgery"));
7. return call_user_func(PRVD_RENAME_PREFIX."curl_exec", $ch);
8. }
/var/www/html/include/dedehttpdown.class.php in PrivateStartSession at line 363
1. }
3. curl_setopt($this->m_ch, CURLOPT_CONNECTTIMEOUT, 20);
4. curl_setopt($this->m_ch, CURLOPT_TIMEOUT, 900);
6. $this->m_html = curl_exec($this->m_ch);
7. $status = curl_getinfo($this->m_ch);
8. if (count($status) > 0) {
9. foreach ($status as $key => $value) {
10. $key = str_replace("_", "-", $key);
11. if ($key == "http-code") {
/var/www/html/include/dedehttpdown.class.php in OpenUrl at line 128
1. $this->reTry = 0;
2. $this->Close();
4. //初始化系统
5. $this->PrivateInit($url);
6. $this->PrivateStartSession($requestType);
7. }
9. /**
10. * 转到303重定向网址
11. *
/var/www/html/include/dedecollection.class.php in DownOnePage at line 516
1. * @access public
2. * @param string $dourl 下载地址
3. */
4. function DownOnePage($dourl)
5. {
6. $this->cHttpDown->OpenUrl($dourl);
7. $html = $this->cHttpDown->GetHtml();
8. $this->cHttpDown->Close();
9. $this->ChangeCode($html);
10. return $html;
11. }
/var/www/html/include/dedecollection.class.php in DownUrl at line 252
1. function DownUrl($aid, $dourl, $litpic='', $issave=TRUE)
2. {
3. $this->tmpLinks = array();
4. $this->tmpUnitValue = '';
5. $this->breImage = '';
6. $this->tmpHtml = $this->DownOnePage($dourl);
8. //检测是否有分页字段，并预先处理
9. if(!empty($this->artNotes['sppage']))
10. {
11. $noteid = '';
/var/www/html/include/dedecollection.class.php in TestArt at line 984
1. * @param $dourl 操作地址
2. * @return string
3. */
4. function TestArt($dourl)
5. {
6. return $this->DownUrl(0, $dourl, '', FALSE);
7. }
9. /**
10. * 采集种子网址
11. *
templets/co_add_step2_test.htm in require_once at line 38
1. <?php
2. if($previewurl=='') echo "你没有指定测试时使用的文章网址，因此系统无法进行测试！";
3. else {
4. $dc = new DedeCollection();
5. $dc->LoadNote($nid);
6. echo "<textarea name='test' style='width:100%;height:450px'>".$dc->TestArt($previewurl)."</textarea>";
7. }
8. ?>
9. </td>
10. </tr>
11. <tr>
co_add.php at line 174
1. {/dede:item}\r\n";
2. }
3. $dsql->ExecuteNoneQuery("UPDATE `#@__co_note` SET itemconfig='$itemconfig' WHERE nid='$nid' ");
4. //echo $dsql->GetError();
5. require_once(DEDEINC.'/dedecollection.class.php');
6. require_once(DEDEADMIN."/templets/co_add_step2_test.htm");
7. exit();
8. }
9. else if($step==6)
10. {
11. $dsql->ExecuteNoneQuery("UPDATE `#@__co_note` SET isok='1' WHERE nid='$nid' ");

Breadcrumbs

21:28:43

error_reporting	`mysqli_query() expects parameter 1 to be mysqli, string given`
line	6
code	2
file	/data/prvd/src/sink/sqli/001-mysqli_query.php

21:28:43

error_reporting	`Undefined offset: 1`
line	114
code	8
file	/var/www/html/include/dedesqli.class.php

21:28:43

error_reporting	`Undefined variable: ch`
line	612
code	8
file	/var/www/html/include/dedehttpdown.class.php

21:28:43

error_reporting	`curl_close() expects parameter 1 to be resource, null given`
line	612
code	2
file	/var/www/html/include/dedehttpdown.class.php

21:28:43

error_reporting	`fclose() expects parameter 1 to be resource, string given`
line	614
code	2
file	/var/www/html/include/dedehttpdown.class.php

21:28:43

error_reporting	`Undefined index: host`
line	53
code	8
file	/var/www/html/include/dedehttpdown.class.php

21:28:43

error_reporting	`Undefined index: host`
line	80
code	8
file	/var/www/html/include/dedehttpdown.class.php

21:28:43
message
服务器端请求伪造

Formatted curl

POST/dede/co_add.phplocalhost

正文

b12	保存配置并预览
channelid	1
descriptiontrim
erul	5
fields	body
fields	pubdate
fields	source
fields	title
fields	writer
function_body
function_pubdate	@me=GetMkTime(@me);
isdown_body	1
isunit_body	1
keywordtrim
match_body
match_pubdate
match_source
match_title	<title>[内容]</title>
match_writer
nid	5
previewurl	'"><xtanzi>./../xtanzi
sppage
sptype	full
srul	1
step	5
trim_body
trim_pubdate
trim_source
trim_title
trim_writer
value_body

Cookies

DedeLoginTime	1541766503
DedeLoginTime__ckMd5	be38df79a9298232
DedeUserID	1
DedeUserID__ckMd5	5ebcf2784562fcbb
PHPSESSID	********
_csrf_name_36da6296	d769aa52e6fd810e6969605155173d8d
_csrf_name_36da6296__ckMd5	fd74c8a16f6cf59f
menuitems	1_1,2_1,3_1,4_1,5_1

标头

Accept	text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding	gzip, deflate, br
Accept-Language	zh-CN,zh;q=0.9,en;q=0.8
Cache-Control	max-age=0
Connection	keep-alive
Content-Length	560
Content-Type	application/x-www-form-urlencoded
Host	localhost:8080
Origin	http://localhost:8080
Prvd-Fuzzer	halo_from_fate0
Referer	http://localhost:8080/dede/co_add.php
Upgrade-Insecure-Requests	1
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

User

Runtime

Name	php
Version	7.2.9

SDK

姓名	sentry-php
版本	1.9.2

Ownership Rules

Create Ownership Rule

All Environments

首次出现时间

时间:: a few seconds ago
Nov 9, 2018 9:28:43 PM HKT
版本:: not configured

最后出现时间

时间:: a few seconds ago
Nov 9, 2018 9:28:43 PM HKT
版本:: not configured

通知

由于已订阅工作流通知你正在接受该项目的更新。

bigfile_info	[]
dede_admin_channel	0
dede_admin_id	1
dede_admin_name	admin
dede_admin_purview	admin_AllowAll
dede_admin_style	newdedecms
dede_admin_type	10
file_info	[]
securimage_code_value	2h9o
token	878d78d1285914e1d5dfa077694de322

dedecms

服务器端请求伪造

问题 #

事件

用户

Assignee

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

POST/dede/co_add.phplocalhost

正文

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

通知

aid	0
dourl	\'\"><xtanzi>./../xtanzi
issave	false
litpic

dedecms

服务器端请求伪造

问题 #

事件

用户

Assignee

事件 d6bd950a194d4fca983fb00e14228cec

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

Breadcrumbs

POST/dede/co_add.phplocalhost

正文

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

通知