漏洞一:
跟进代码/admin/shopinfo.php: [Bash shell] 纯文本查看 复制代码
if ($_REQUEST['act'] == 'edit')
{
/* 权限判断 */
admin_priv('shopinfo_manage');
/* 取得文章数据 */
$sql = "SELECT article_id, title, content FROM ".$ecs->table('article')."WHERE article_id =".$_REQUEST['id'];
$article = $db->GetRow($sql);
/* 创建 html editor */
create_html_editor('FCKeditor1', $article['content']);
$smarty->assign('ur_here', $_LANG['article_add']);
$smarty->assign('action_link', array('text' => $_LANG['shopinfo_list'], 'href'=>'shopinfo.php?act=list'));
$smarty->assign('article', $article);
$smarty->assign('form_action', 'update');
$smarty->display('shopinfo_info.htm');
}
触发漏洞: http://localhost/admin/shopinfo.php?act=edit&id=1
下面漏洞,我是读完ECShop_V2.7.3_UTF8_release1106 在读代码,找到的漏洞.
漏洞二: 跟进/admin/affiliate_ck.php代码: [Bash shell] 纯文本查看 复制代码
if ($_REQUEST['act'] == 'list')
{
$logdb = get_affiliate_ck();
$smarty->assign('full_page', 1);
$smarty->assign('ur_here', $_LANG['affiliate_ck']);
$smarty->assign('on', $separate_on);
$smarty->assign('logdb', $logdb['logdb']);
$smarty->assign('filter', $logdb['filter']);
$smarty->assign('record_count', $logdb['record_count']);
$smarty->assign('page_count', $logdb['page_count']);
if (!empty($_GET['auid']))
{
$smarty->assign('action_link', array('text' => $_LANG['back_note'], 'href'=>"users.php?act=edit&id=$_GET[auid]"));
}
assign_query_info();
$smarty->display('affiliate_ck_list.htm');
}
跟进get_affiliate_ck() 函数 [Bash shell] 纯文本查看 复制代码
function get_affiliate_ck()
{
$affiliate = unserialize($GLOBALS['_CFG']['affiliate']);
empty($affiliate) && $affiliate = array();
$separate_by = $affiliate['config']['separate_by'];
$sqladd = '';
if (isset($_REQUEST['status']))
{
$sqladd = ' AND o.is_separate = ' . (int)$_REQUEST['status'];
$filter['status'] = (int)$_REQUEST['status'];
}
if (isset($_REQUEST['order_sn']))
{
$sqladd = ' AND o.order_sn LIKE \'%' . trim($_REQUEST['order_sn']) . '%\'';
$filter['order_sn'] = $_REQUEST['order_sn'];
}
if (isset($_GET['auid']))
{
$sqladd = ' AND a.user_id=' . $_GET['auid'];
}
if(!empty($affiliate['on']))
{
if(empty($separate_by))
{
//推荐注册分成
$sql = "SELECT COUNT(*) FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND (u.parent_id > 0 AND o.is_separate = 0 OR o.is_separate > 0) $sqladd";
}
else
{
//推荐订单分成
$sql = "SELECT COUNT(*) FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND (o.parent_id > 0 AND o.is_separate = 0 OR o.is_separate > 0) $sqladd";
}
}
else
{
$sql = "SELECT COUNT(*) FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND o.is_separate > 0 $sqladd";
}
$filter['record_count'] = $GLOBALS['db']->getOne($sql);
$logdb = array();
/* 分页大小 */
$filter = page_and_size($filter);
if(!empty($affiliate['on']))
{
if(empty($separate_by))
{
//推荐注册分成
$sql = "SELECT o.*, a.log_id, a.user_id as suid, a.user_name as auser, a.money, a.point, a.separate_type,u.parent_id as up FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND (u.parent_id > 0 AND o.is_separate = 0 OR o.is_separate > 0) $sqladd".
" ORDER BY order_id DESC" .
" LIMIT " . $filter['start'] . ",$filter[page_size]";
/*
SQL解释：
列出同时满足以下条件的订单分成情况：
1、有效订单o.user_id > 0
2、满足以下情况之一：
a.有用户注册上线的未分成订单 u.parent_id > 0 AND o.is_separate = 0
b.已分成订单 o.is_separate > 0
*/
}
else
{
//推荐订单分成
$sql = "SELECT o.*, a.log_id,a.user_id as suid, a.user_name as auser, a.money, a.point, a.separate_type,u.parent_id as up FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND (o.parent_id > 0 AND o.is_separate = 0 OR o.is_separate > 0) $sqladd" .
" ORDER BY order_id DESC" .
" LIMIT " . $filter['start'] . ",$filter[page_size]";
/*
SQL解释：
列出同时满足以下条件的订单分成情况：
1、有效订单o.user_id > 0
2、满足以下情况之一：
a.有订单推荐上线的未分成订单 o.parent_id > 0 AND o.is_separate = 0
b.已分成订单 o.is_separate > 0
*/
}
}
else
{
//关闭
$sql = "SELECT o.*, a.log_id,a.user_id as suid, a.user_name as auser, a.money, a.point, a.separate_type,u.parent_id as up FROM " . $GLOBALS['ecs']->table('order_info') . " o".
" LEFT JOIN".$GLOBALS['ecs']->table('users')." u ON o.user_id = u.user_id".
" LEFT JOIN " . $GLOBALS['ecs']->table('affiliate_log') . " a ON o.order_id = a.order_id" .
" WHERE o.user_id > 0 AND o.is_separate > 0 $sqladd" .
" ORDER BY order_id DESC" .
" LIMIT " . $filter['start'] . ",$filter[page_size]";
}
$query = $GLOBALS['db']->query($sql);
while ($rt = $GLOBALS['db']->fetch_array($query))
{
if(empty($separate_by) && $rt['up'] > 0)
{
//按推荐注册分成
$rt['separate_able'] = 1;
}
elseif(!empty($separate_by) && $rt['parent_id'] > 0)
{
//按推荐订单分成
$rt['separate_able'] = 1;
}
if(!empty($rt['suid']))
{
//在affiliate_log有记录
$rt['info'] = sprintf($GLOBALS['_LANG']['separate_info2'], $rt['suid'], $rt['auser'], $rt['money'], $rt['point']);
if($rt['separate_type'] == -1 || $rt['separate_type'] == -2)
{
//已被撤销
$rt['is_separate'] = 3;
$rt['info'] = "<s>" . $rt['info'] . "</s>";
}
}
$logdb[] = $rt;
}
$arr = array('logdb' => $logdb, 'filter' => $filter, 'page_count' => $filter['page_count'], 'record_count' => $filter['record_count']);
return $arr;
}
可以看到关键点: $sqladd = ' AND a.user_id=' . $_GET['auid']; Auid函数没过滤,直接插进sql注入 访问:http://localhost/admin/affiliate_ck.php?act=list&auid=1 即可触发漏洞 用sqlmap时间盲注可以注入成功
漏洞三: 跟进/admin/shophelp.php代码: [Bash shell] 纯文本查看 复制代码
if ($_REQUEST['act'] == 'update')
{
/* 权限判断 */
admin_priv('shophelp_manage');
/* 检查重名 */
if ($_POST['title'] != $_POST['old_title'] )
{
$exc_article->is_only('title', $_POST['title'], $_LANG['articlename_exist'], $_POST['id']);
}
/* 更新 */
if ($exc_article->edit("title = '$_POST[title]', cat_id = '$_POST[cat_id]', article_type = '$_POST[article_type]', content = '$_POST[FCKeditor1]'", $_POST['id']))
{
/* 清除缓存 */
clear_cache_files();
$link[0]['text'] = $_LANG['back_list'];
$link[0]['href'] = 'shophelp.php?act=list_article&cat_id='.$_POST['cat_id'];
sys_msg(sprintf($_LANG['articleedit_succeed'], $_POST['title']), 0, $link);
admin_log($_POST['title'], 'edit', 'shophelp');
}
}
可以看到$exc_article->is_only('title', $_POST['title'], $_LANG['articlename_exist'], $_POST['id']); 未对id参数进行过滤;
跟进is_only [Bash shell] 纯文本查看 复制代码
function is_only($col, $name, $id = 0, $where='')
{
$sql = 'SELECT COUNT(*) FROM ' .$this->table. " WHERE $col = '$name'";
$sql .= empty($id) ? '' : ' AND ' . $this->id . " <> '$id'";
$sql .= empty($where) ? '' : ' AND ' .$where;
echo $sql;
return ($this->db->getOne($sql) == 0);
}
$_POST['id'] 直接当作where参数,直接插入sql注入语句 触发漏洞: http://localhost/admin/shophelp.php?act=update title=1&old_title=2&id=1=1
挖的漏洞质量不高,但本人对渗透还有审计,都兴趣浓厚,希望能加入90sec,学审计和渗透..也希望能认识更多的朋友
=====================================
10位正式成员同意，转正成功。
管理05
|