这段php代码中是否存在安全漏洞?


Are there any security vulnerabilities in this php code?

我想知道这个代码中是否有任何安全漏洞:

<?php
/*
    Plugin Name: Dashboard Switcher
    Plugin URI: http://wordpress.org/extend/plugins/dashboard-switcher/
    Description: Adds a dropdown list of the sites with every site owned in a network to quickly switch between them.
    Version: 0.1
    Author: Ezequiel Livinsky
    Author URI: http://livindev.com.ar
*/
    add_action('in_admin_header', 'own_favorite_actions');
    function own_favorite_actions() {
        if(!is_super_admin()) return;
        global $wpdb, $current_blog;
        $blogs = $wpdb->get_results("SELECT domain FROM $wpdb->blogs WHERE blog_id <> $current_blog->blog_id", ARRAY_A);
        $actions = array();
        foreach($blogs as $row){
            $url = 'http://'.$row['domain'].$_SERVER['REQUEST_URI'];
            $actions[$url] = $row['domain'];
        }
        $first = array_keys($actions);
        $first = $first[0];
        echo '<div id="favorite-actions">';
        echo '<div id="favorite-first"><a href="' . $first . '">' . $actions[$first] . '</a></div><div id="favorite-toggle"><br /></div>';
        echo '<div id="favorite-inside">';
        foreach ( $actions as $action => $label) {
            echo "<div class='favorite-action'><a href='$action'>";
            echo $label;
            echo "</a></div>'n";
        }
        echo "</div></div>'n";
    }
?>

是的,$_SERVER['REQUEST_URI']是未经任何处理的输出(即。htmlspecialchars)通过$action和$first,所以它提供了一个XSS(跨站脚本)漏洞。

例如:/index.php?foo="><script>alert("hi!");</script><"将输出为<a href="/index.php?foo="><script>alert("hi!");</script><">label</a>,允许攻击者给出一个URL,从你的域名运行javascript。

在实践中,magic_quotes_gpc可能会缓解这个问题,但它仍然是一个值得注意的漏洞,应该修复