Your IP : 44.197.238.222
 
  ¼­ºñ½º ÀÌ¿ë¹æ¹ý
  ÀÚÁÖÇÏ´Â Áú¹®
  Q&A °Ô½ÃÆÇ
  ÀÚ·á½Ç
  °øÁö»çÇ×
Home > °í°´Áö¿ø > °øÁö»çÇ×      


  ÀÌ   ¸§   °ü¸®ÀÚ (IP : 210.221.204.5)
  Á¦   ¸ñ   [°øÁö]±×´©º¸µå 4.34.16 XSS Ãë¾àÁ¡ ±Ç°í¿¡ ´ëÇÑ ¼öÁ¤
  µî·ÏÀÏ   2011-11-17 15:04:05
  È¨ÆäÀÌÁö   http://www.topmania.com
  Á¶È¸¼ö   3340
  ³»   ¿ë
¡à °³¿ä
XSS¶õ Ÿ »ç¿ëÀÚÀÇ Á¤º¸¸¦ ÃßÃâÇϱâ À§ÇØ »ç¿ëµÇ´Â °ø°Ý±â¹ýÀ¸·Î »ç¿ëÀÚÀÇ ÀÔ·ÂÀ» ¹Þ¾ÆµéÀÌ´Â °÷(°Ô½ÃÆÇÀ̳ª °Ë»öâ)¿¡ ½ºÅ©¸³Æ® Äڵ带 Â÷´ÜÇÏÁö ¾ÊÀ½À¸·Î½á °ø°ÝÀÚ°¡ ½ºÅ©¸³Æ® Äڵ带 ½ÇÇàÇÒ ¼ö ÀÖ°Ô µË´Ï´Ù. »ç¿ëÀÚ°¡ ÀÔ·ÂÇÑ ¹®ÀÚ¿­À» ÀúÀåÇÏ¿´´Ù°¡, ´Ù¸¥ »ç¿ëÀÚ°¡ ÇØ´ç °Ô½Ã¹°À» Àоîµé¿´À» ¶§ ±×´ë·Î Àü¼ÛµÇ¾îÁö´Âµ¥ ÀÌ°ÍÀ» ÀÌ¿ëÇÏ¿© °ø°ÝÄڵ尡 Æ÷ÇÔµÈ ¹®ÀÚ¿­À» ÀÛ¼ºÇÏ¿© ±×°ÍÀ» ÀоîµéÀÎ ÇÇÇØÀÚ¿¡°Ô °ø°ÝÀ» °¡ÇÏ°Ô µË´Ï´Ù.

¡à Á¶Ä¡ ¹æ¹ý
Ãß°¡·Î ÇÏ´Ü¿¡ ³Ö´Â °ÍÀÌ ¾Æ´Ï¶ó ±âÁ¸ÀÇ ³»¿ëÀ» À§Ä¡¸¸ ¿Å±â´Â °Í ÀÔ´Ï´Ù.

lib/common.lib.php ÀÇ function conv_content() ¿¡¼­

$content = preg_replace("#\/\*.*\*\/#iU", "", $content);

ÀÌ ÄÚµåÀÇ À§Ä¡¸¦ ¾Æ·¡¿Í °°Àº ÇüÅ·Π¹Ù²ã ÇØ°áÇÕ´Ï´Ù.


....»ý·«

// ÀÌ·± °æ¿ì¸¦ ¹æÁöÇÔ
$content = preg_replace("#\/\*.*\*\/#iU", "", $content);

$content = preg_replace("/(on)([a-z]+)([^a-z]*)(\=)/i", "on$2$3$4", $content);
$content = preg_replace("/(dy)(nsrc)/i", "dy$2", $content);
$content = preg_replace("/(lo)(wsrc)/i", "lo$2", $content);
$content = preg_replace("/(sc)(ript)/i", "sc$2", $content);
//$content = preg_replace("/(ex)(pression)/i", "ex$2", $content);
$content = preg_replace("/\<(\w|\s|\?)*(xml)/i", "", $content);

// À̹ÌÁö ű×ÀÇ src ¼Ó¼º¿¡ »èÁ¦µîÀÇ ¸µÅ©°¡ ÀÖ´Â °æ¿ì °Ô½Ã¹°À» È®ÀÎÇÏ´Â °Í¸¸À¸·Îµµ µ¥ÀÌÅÍÀÇ À§º¯Á¶°¡ °¡´ÉÇϹǷΠÀÌ°ÍÀ» ¸·À½
$content = preg_replace("/<(img[^>]+delete\.php[^>]+bo_table[^>]+)/i", "*** CSRF °¨Áö : <$1", $content);
$content = preg_replace("/<(img[^>]+delete_comment\.php[^>]+bo_table[^>]+)/i", "*** CSRF °¨Áö : <$1", $content);
$content = preg_replace("/<(img[^>]+logout\.php[^>]+)/i", "*** CSRF °¨Áö : <$1", $content);
$content = preg_replace("/<(img[^>]+download\.php[^>]+bo_table[^>]+)/i", "*** CSRF °¨Áö : <$1", $content);

....»ý·«

¡à Âü°í »çÀÌÆ®
http://sir.co.kr/bbs/board.php?bo_table=g4_pds&wr_id=6782&page=2


 


ȸ»ç¼Ò°³  -  Çù·Â¾÷ü  -  °³ÀÎÁ¤º¸Ãë±Þ¹æħ  -  À̸ÞÀϼöÁý°ÅºÎ  
Copyright (c) 1999~2014 TopMania Corp. All right reserved.
Mail to master@topmania.com
  ¼­¿ïƯº°½Ã ±Ýõ±¸ °¡¸¶»ê·Î 96 ´ë¸¢Å×Å©³ëŸ¿î 8Â÷ 10Ãþ 1012È£
»óÈ£ : ÁÖ½Äȸ»ç ž¸Å´Ï¾Æ »ç¾÷ÀÚµî·Ï¹øÈ£ : 107-86-34372 ´ëÇ¥ÀÌ»ç : À±¹®È«
Åë½ÅÆǸž÷ ½Å°í : ±Ýõ Á¦ 18-813È£              °³ÀÎÁ¤º¸°ü¸® Ã¥ÀÓÀÚ : À̵ÎÁø
°í°´»ó´ã ¹× ´ëÇ¥ÀüÈ­ : 02-862-3131 FAX : 0505-862-3131