Preface
This article fully and thoroughly reproduces every vulnerability case mentioned in the book Code Auditing: Enterprise Web Code Security Architecture and provides the source code packages, so that newcomers who start with this book can reproduce the cases themselves and gain a deeper understanding.
Vulnerability Title
BugFree Reinstallation Vulnerability Case, p. 66 of the book
Preparations
- Install the BugFree source code package
- Phpstorm integrated development environment
- Burpsuite or another tool capable of intercepting traffic
Getting Started
- The vulnerability appears in the install/index.php file. The code is shown below:
- As shown in the image, the business logic first checks whether the installation lock file exists. If it exists, this means the application has already been installed, so it redirects to the home page. However, because there is no exit() or die() to terminate the program, the subsequent code will still execute. The installation program's page will therefore be returned to the front-end user , but because of the header() function, the program also returns a 302 status code to the browser. After receiving it, the browser automatically redirects to the home page. However, if we use burpsuite to intercept the response packet and change the 302 status code to a 200 status code, we can receive the reinstallation program's page, as shown below:
- After changing the 302 status code to 200, the browser no longer redirects to the home page
