乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-02-18: 细节已通知厂商并且等待厂商处理中 2014-02-24: 厂商已经确认,细节仅向厂商公开 2014-02-27: 细节向第三方安全合作伙伴开放 2014-04-20: 细节向核心白帽子及相关领域专家公开 2014-04-30: 细节向普通白帽子公开 2014-05-10: 细节向实习白帽子公开 2014-05-19: 细节向公众公开
Sql Injection
注入在XDCMS企业管理系统后台的模型发布处,\system\modules\xdcms\model.php文件:管理员在发布模型和编辑模型的时候会分别调用model_add_save()和model_edit_save()函数,三个注入点就出现在这两个函数里:model_add_save()函数:
public function model_add_save(){ $modelname=safe_html($_POST['modelname']);//safe_html可被大写绕过 $modeltable=$_POST['modeltable'];//未过滤,直接注入 $modeltable_content=get_content_table($modeltable); $is_lock=$_POST['is_lock']; $is_fixed=$_POST['is_fixed']; if(empty($modelname)||empty($modeltable)){ showmsg(C('material_not_complete'),'-1'); } if(!check_str($modeltable,'/^[a-z0-9][a-z0-9]*$/')){ showmsg(C('table').C('numbers_and_letters'),'-1'); } $tables=$this->mysql->show_table(); if(in_array(DB_PRE.$modeltable,$tables)){ showmsg(C('table_exist'),'-1'); } if(in_array(DB_PRE.$modeltable_content,$tables)){ showmsg(C('table_exist'),'-1'); } $this->mysql->db_insert('model',"`model_name`='".$modelname."',`model_table`='".$modeltable."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed); $field="`id` int(8) unsigned NOT NULL AUTO_INCREMENT,`catid` tinyint(5) unsigned NOT NULL DEFAULT '0',`title` char(80) NOT NULL,`thumb` char(100) NOT NULL,`keywords` char(40) NOT NULL,`description` char(255) NOT NULL,`commend` tinyint(1) unsigned NOT NULL DEFAULT '0',`url` char(100) NOT NULL,`userid` mediumint(8) unsigned NOT NULL DEFAULT '0',`username` char(20) NOT NULL,`inputtime` int(10) unsigned NOT NULL DEFAULT '0',`updatetime` int(10) unsigned NOT NULL DEFAULT '0',`hits` int(8) unsigned NOT NULL DEFAULT '0',`sort` int(8) unsigned NOT NULL DEFAULT '0',`style` char(20) default NULL,PRIMARY KEY (`id`)"; $field_content="id int(8) not null,PRIMARY KEY (`id`)"; $this->mysql->create_table($modeltable,$field); $this->mysql->create_table($modeltable_content,$field_content); $this->cache->model_cache(); showmsg(C('add_success'),'-1'); }
model_edit_save()函数:
public function model_edit_save(){ $id=isset($_POST['id'])?intval($_POST['id']):0; $modelname=safe_html($_POST['modelname']);//可大写绕过 $is_lock=$_POST['is_lock']; $is_fixed=isset($_POST['is_fixed'])?intval($_POST['is_fixed']):1; if(empty($modelname)){ showmsg(C('material_not_complete'),'-1'); } $this->mysql->db_update("model","`model_name`='".$modelname."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed."","`id`=".$id); $this->cache->model_cache(); showmsg(C('update_success'),'-1'); }
添加模型处以modelname为例,点击模型添加:
抓包添加exp:
成功:
管理模型处modelname,点击编辑:
抓包加exp:
过滤!
危害等级:中
漏洞Rank:5
确认时间:2014-02-24 22:23
存在没过滤
暂无