当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-062045

漏洞标题:YouYaX某处SQL注入

相关厂商:youyax.com

漏洞作者: 只发通用型

提交时间:2014-05-27 10:36

修复时间:2014-08-25 10:38

公开时间:2014-08-25 10:38

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经修复

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-05-27: 细节已通知厂商并且等待厂商处理中
2014-05-27: 厂商已经确认,细节仅向厂商公开
2014-07-21: 细节向核心白帽子及相关领域专家公开
2014-07-31: 细节向普通白帽子公开
2014-08-10: 细节向实习白帽子公开
2014-08-25: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

YouYaX是良心厂商~所以来刷点洞,第一个

详细说明:

/ext/register.php 文件
当($mix['is_prevent_reg']为true时

if($mix['is_prevent_reg']){
if (!empty($_SERVER['HTTP_CLIENT_IP']))
$myIp = $_SERVER['HTTP_CLIENT_IP'];
else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
$myIp = $_SERVER['HTTP_X_FORWARDED_FOR'];
else
$myIp = $_SERVER['REMOTE_ADDR'];
$sql = "select * from " . $config['db_prefix'] . "user where ip_addr='" . $myIp . "'";
$result = mysql_query($sql);
$num = mysql_num_rows($result);


可以伪造IP进行注入,因为不回显应该是用延时注入比较合适.
这里echo 出sql语句做一下漏洞证明

1.jpg

漏洞证明:

1.jpg


为了管理员复现漏洞方便(该CMS还要配置邮件服务器,我注释这些代码)
复制了我的代码上来你复现直接粘贴上去就可以了

<?php
include('../ext_public/include.php');
include('../ext_public/database.php');
function doUserCount($param){
$count_arr = mysql_fetch_array(mysql_query("select * from " . $param . "count where id=1"));
$data=unserialize($count_arr['user_count']);
$date=date('w', time());
$date2=date('W',time());
if($date2 != $count_arr['week_order']){
mysql_query("update " . $param . "count set user_count='',post_count='',week_order='".$date2."' where id=1");
$count_arr = mysql_fetch_array(mysql_query("select * from " . $param . "count where id=1"));
$data=unserialize($count_arr['user_count']);
}
switch($date){
case 0:
@$data['g']++;
break;
case 1:
@$data['a']++;
break;
case 2:
@$data['b']++;
break;
case 3:
@$data['c']++;
break;
case 4:
@$data['d']++;
break;
case 5:
@$data['e']++;
break;
case 6:
@$data['f']++;
break;
}
mysql_query("update " . $param . "count set user_count='".serialize($data)."' where id=1");
}
if (isset($_POST['sub'])) {
if(empty($config['default_user_group'])||empty($config['not_log_in_user_group'])){
echo "<script>alert('请至后台[注册激活管理-配置]设置注册和未登陆默认用户组');</script>";
exit;
}
$user = htmlspecialchars(addslashes(trim($_POST['user'])), ENT_QUOTES, "UTF-8");
if(mb_strlen($user,'utf8')>7 || mb_strlen($user,'utf8')<2){
echo "<script>alert('用户名长度必须在2~7个字符之间');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
exit;
}
if (empty($_POST['pass'])) {
echo "<script>alert('密码必填');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
exit;
}
$pass = md5(addslashes($_POST['pass']));
$_POST['email']=addslashes($_POST['email']);
if (empty($_POST['email'])) {
echo "<script>alert('邮箱名必填');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
exit;
}
if($mix['is_prevent_reg']){
if (!empty($_SERVER['HTTP_CLIENT_IP']))
$myIp = $_SERVER['HTTP_CLIENT_IP'];
else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
$myIp = $_SERVER['HTTP_X_FORWARDED_FOR'];
else
$myIp = $_SERVER['REMOTE_ADDR'];
$sql = "select * from " . $config['db_prefix'] . "user where ip_addr='" . $myIp . "'";
$result = mysql_query($sql);
var_dump($sql);
$num = mysql_num_rows($result);
if($num >= $mix['prevent_reg_num']){
echo "<script>alert('注册失败,此IP地址已经使用超过 ".$mix['prevent_reg_num']." 次了');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
exit;
}
}
$code = '';
for ($i = 0; $i < 6; $i++) {
$code .= mt_rand(0, 9);
}
if($config['register_mode']==1){
/* $mailconf = require("../Conf/mail.config.php");
if(empty($mailconf['mail_Host'])&&empty($mailconf['mail_Username'])&&empty($mailconf['mail_Password'])){
echo "<script>alert('管理员后台未配置邮件服务器');</script>";
exit;
}*/
}
mysql_query("SET NAMES 'utf8'");
mysql_query("SET sql_mode=''");
date_default_timezone_set('Asia/Shanghai');
$sql = "select * from " . $config['db_prefix'] . "user where user='" . $user . "'";
$result = mysql_query($sql);
$num = mysql_num_rows($result);
//判断是否被注册
if ($num > 0) {
echo "<script>alert('该用户名已被注册');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
} else {
$sql2 = "select * from " . $config['db_prefix'] . "user where email='" . $_POST['email'] . "'";
$result2 = mysql_query($sql2);
$num2 = mysql_num_rows($result2);
if ($num2 > 0) {
echo "<script>alert('邮箱名已被注册');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
exit;
} else {
if($config['register_mode']==1){
/* require_once("../ext_public/phpmailer/class.phpmailer.php");
$mail = new PHPMailer();
$mail->IsSMTP();
$mail->Host = $mailconf['mail_Host'];
$mail->SMTPAuth = true;
$mail->Username = $mailconf['mail_Username'];
$mail->Password = $mailconf['mail_Password'];
$mail->From = $mailconf['mail_From'];
$mail->FromName = $mailconf['mail_FromName'];
$mail->AddAddress($_POST['email']);
$mail->IsHTML(true);
$mail->CharSet = "UTF-8";
$mail->Encoding = "base64";
$mail->Subject = $mailconf['mail_Subject'];
$mail->Body = $mailconf['mail_Body'] . "<a href='" . url_site . "/ext/mail_active.php?user=" . $user . "&pass=" . $pass . "&email=" . $_POST['email'] . "&code=" . $code . "'>点此激活</a>";
if (!empty($_POST['email'])) {
exit;
}*/
if($mix['is_prevent_reg']){
$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,ip_addr,user_group) values('" . $user . "','" . $pass . "',0,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','" . $code . "','".$myIp."','".$config['default_user_group']."')";
}else{
$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,user_group) values('" . $user . "','" . $pass . "',0,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','" . $code . "','".$config['default_user_group']."')";
}
mysql_query($sql);
doUserCount($config['db_prefix']);
echo "<script>alert('注册成功,请至邮箱激活!');</script>";
echo "<script>window.parent.location.href='" . url_site . "';</script>";
}else{
if(addslashes($_POST['valicode'])!=$_SESSION['verify']){
echo "<script>alert('输入的验证码不正确!');</script>";
exit;
}else{
if($mix['is_prevent_reg']){
$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,ip_addr,user_group) values('" . $user . "','" . $pass . "',1,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','". $code . "','".$myIp."','".$config['default_user_group']."')";
}else{
$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,user_group) values('" . $user . "','" . $pass . "',1,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','". $code . "','".$config['default_user_group']."')";
}
mysql_query($sql);
doUserCount($config['db_prefix']);
echo "<script>alert('注册成功!');</script>";
$_SESSION['youyax_data'] = 1;
$_SESSION['youyax_user'] = $user;
$_SESSION['youyax_bz'] = 1;
echo "<script>window.parent.location.href='" . url_site . "';</script>";
}
}
}
}
}
?>

修复方案:

对IP正则判断

版权声明:转载请注明来源 只发通用型@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2014-05-27 12:19

厂商回复:

似乎可以绕过注册限制,多谢反馈

最新状态:

2014-05-27:公开漏洞是为了在程序发展初期,无太多用户积累的情况下更好的检测安全性