The database backup has Command Injection Vulnerability

## Test environment

os : windows;
IBOS version :  IBOS 4.5.4 OPEN

## Code analysis

The backup database function is in the code file ```IBOS\system\core\utils\Database.php``` with line 228.Then it will filter some file types and some sensitive characters.

![test-1](https://images.gitee.com/uploads/images/2020/0117/100349_75c737b3_1763950.png "屏幕截图.png")

in this function,another filter some sensitive characters in line 308.

![test-2](https://images.gitee.com/uploads/images/2020/0117/100707_075585b0_1763950.png "屏幕截图.png")

finally,the run command code was begin in line 434,and it will run in line 453

![test-3](https://images.gitee.com/uploads/images/2020/0117/100930_cda022e7_1763950.png "屏幕截图.png")

Code to execute the command in line 453 is like this.The parameter ```$dumpFile``` will input this command string.

```
`{$mysqlBin}mysqldump --force --quick {$command1} --add-drop-table {$command2} {$command3} --host="{$db['host']}" {$command5} --user="{$db['username']}" --password="{$db['password']}" "{$db['dbname']}" {$tablesstr} > {$dumpFile}`;

```

Because some characters are not filtered, it can still cause command injection.

## Vulnerability Test

login in the IBOS backstage,and enter the database function.For faster execution, only one of the data tables is selected for backup operation.

![test-4](https://images.gitee.com/uploads/images/2020/0117/101553_3926a1e4_1763950.png "屏幕截图.png")

then you need to open the "more",and select as follows like this.

![test-5](https://images.gitee.com/uploads/images/2020/0117/101713_d04c2457_1763950.png "屏幕截图.png")

in this filename,you can input you want to run for command,and I run ```ipconfig``` like this.

![test-6](https://images.gitee.com/uploads/images/2020/0117/101843_5a26e9cf_1763950.png "屏幕截图.png")

### payload

```
2020-01-17_exdEQ1ro&ipconfig>kkkkkk&ss
```

submit it and access url like this ```http://127.0.0.1/kkkkkk```.You can see the results after the command is executed.

![test-7](https://images.gitee.com/uploads/images/2020/0117/102116_a477833b_1763950.png "屏幕截图.png")

## Solution

filter more sensitive characters.

IBOS开源OA协同办公管理/IBOS

Content Risk Flag

Comments (0)

IBOS开源OA协同办公管理/IBOS .gitee-modal { width: 500px !important; }

Content Risk Flag