乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-12-20: 细节已通知厂商并且等待厂商处理中 2013-12-20: 厂商已经确认,细节仅向厂商公开 2013-12-23: 细节向第三方安全合作伙伴开放 2014-02-13: 细节向核心白帽子及相关领域专家公开 2014-02-23: 细节向普通白帽子公开 2014-03-05: 细节向实习白帽子公开 2014-03-20: 细节向公众公开
Thinksaas SQL注入#4
编辑图片信息:
/app/photo/action/edit.php
case "do": if($_POST['token'] != $_SESSION['token']) { tsNotice('非法操作!'); } $photoid = intval($_POST['photoid']); $photoname = tsClean($_POST['photoname']); $photodesc = tsClean($_POST['photodesc']); $new['photo']->update('photo',array( 'photoid'=>$photoid, ),array( 'photoname'=>$photoname, 'photodesc'=>$photodesc, )); header('Location: '.tsUrl('photo','show',array('id'=>$photoid))); break;
跟进tsClean:
function cleanJs($text) { $text = trim ( $text ); $text = stripslashes ( $text ); // 完全过滤注释 $text = preg_replace ( '/<!--?.*-->/', '', $text ); // 完全过滤动态代码 $text = preg_replace ( '/<\?|\?>/', '', $text ); // 完全过滤js $text = preg_replace ( '/<script?.*\/script>/', '', $text ); // 过滤多余html $text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text ); // 过滤on事件lang js while ( preg_match ( '/(<[^><]+)(lang|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1], $text ); } while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1] . $mat [3], $text ); } return $text;}/** * 输入安全过滤 * @param unknown $text * @return mixed */function tsClean($text) { $text = cleanJs ( $text ); return $text;}
同样过滤js相关内容,其他的没过滤跟进update:
public function update($table, $conditions, $row) { $where = ""; if (empty ( $row )) return FALSE; if (is_array ( $conditions )) { $join = array (); foreach ( $conditions as $key => $condition ) { $condition = $this->escape ( $condition ); $join [] = "{$key} = {$condition}"; } $where = "WHERE " . join ( " AND ", $join ); } else { if (null != $conditions) $where = "WHERE " . $conditions; } foreach ( $row as $key => $value ) { $vals [] = "`$key` = '$value'"; } $values = join ( ", ", $vals ); $sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}"; return $this->db->query ( $sql ); }
row内容没有过滤,导致sql注入。
第一步,上传一张照片第二步,修改照片信息:
第三步,抓包,修改post数据,如图:
最后图片的描述信息就会被修改成user()信息。
过滤
危害等级:高
漏洞Rank:20
确认时间:2013-12-20 21:42
感谢反馈,正在修复中。
暂无