VULHUB ™

### 简要描述： 齐博门户二次注入 ### 详细说明： shop\join.php中 ``` if($action=="postnew") { //自定义字段的合法检查与数据处理 $Module_db->checkpost($field_db,$postdb,'');//跟踪 join_post(); unset($id_array); ``` checkpost()函数中 ``` function checkpost($field_db,&$postdb,$rsdb=''){ foreach($field_db AS $key=>$rs) { .................省略 else { if(is_array($postdb[$key])){ $postdb[$key]='/#/'.implode("/#/",$postdb[$key]).'/#/'; } //过滤不安全的字符 $postdb[$key]=filtrate($postdb[$key]);//对传递过来的数据进行过滤 } if(strlen($postdb[$key])>30000){ showerr("内容不能大于1.5万个汉字"); } } } ``` 上面的我无法利用，但是在shop//member/address.php中 ``` elseif($action=="postnew"){ $db->query("INSERT INTO `{$_pre}address` (`uid` ,`order_username` ,`order_phone` ,`order_mobphone` ,`order_email` ,`order_qq` ,`order_postcode` ,`order_address` ) VALUES ('$lfjuid', '$order_username', '$order_phone', '$order_mobphone', '$order_email', '$order_qq', '$order_postcode', '$order_address')");//直接转义之后入库 refreshto("?job=list",'',0); }elseif($action=="edit"){ checkrid($rid);...

### 简要描述： 齐博门户二次注入 ### 详细说明： shop\join.php中 ``` if($action=="postnew") { //自定义字段的合法检查与数据处理 $Module_db->checkpost($field_db,$postdb,'');//跟踪 join_post(); unset($id_array); ``` checkpost()函数中 ``` function checkpost($field_db,&$postdb,$rsdb=''){ foreach($field_db AS $key=>$rs) { .................省略 else { if(is_array($postdb[$key])){ $postdb[$key]='/#/'.implode("/#/",$postdb[$key]).'/#/'; } //过滤不安全的字符 $postdb[$key]=filtrate($postdb[$key]);//对传递过来的数据进行过滤 } if(strlen($postdb[$key])>30000){ showerr("内容不能大于1.5万个汉字"); } } } ``` 上面的我无法利用，但是在shop//member/address.php中 ``` elseif($action=="postnew"){ $db->query("INSERT INTO `{$_pre}address` (`uid` ,`order_username` ,`order_phone` ,`order_mobphone` ,`order_email` ,`order_qq` ,`order_postcode` ,`order_address` ) VALUES ('$lfjuid', '$order_username', '$order_phone', '$order_mobphone', '$order_email', '$order_qq', '$order_postcode', '$order_address')");//直接转义之后入库 refreshto("?job=list",'',0); }elseif($action=="edit"){ checkrid($rid); $db->query("UPDATE `{$_pre}address` SET order_username='$order_username',order_phone='$order_phone',order_email='$order_email',order_qq='$order_qq',order_postcode='$order_postcode',order_address='$order_address',order_mobphone='$order_mobphone' WHERE rid='$rid'");//转移后入库 refreshto("?job=list",'',0); } ``` 在shop\join.php中 ``` if($action=="postnew") { //自定义字段的合法检查与数据处理 $Module_db->checkpost($field_db,$postdb,''); join_post();//跟踪 ``` join_post()函数中 ``` function join_post(){ extract($GLOBALS); global $postdb,$listdb; if(!table_field("{$_pre}join",'products')){ $db->query("ALTER TABLE `{$_pre}join` ADD `products` TEXT NOT NULL ;"); } $query = $db->query("SELECT * FROM {$_pre}content WHERE id IN (".implode(',',$_ar).")"); while($rs = $db->fetch_array($query)){ $rs[price] = str_replace(',','',$rs[price]); $listdb[$rs[uid]][] = $rs; /* var_dump($listdb); exit; */ } if($postdb[address_type]>0){ $ts = $db->get_one("SELECT * FROM `{$_pre}address` WHERE uid='$lfjuid' AND rid='$postdb[address_type]'"); //数据出库 $postdb[order_username] = $ts[order_username]; $postdb[order_phone] = $ts[order_phone]; $postdb[order_mobphone] = $ts[order_mobphone]; $postdb[order_email] = $ts[order_email]; $postdb[order_qq] = $ts[order_qq]; $postdb[order_postcode] = $ts[order_postcode]; $postdb[order_address] = $ts[order_address]; }elseif($postdb[address_type]=='-1'){ $db->query("INSERT INTO `{$_pre}address` ( `uid` , `order_username` , `order_phone` , `order_mobphone` , `order_email` , `order_qq` , `order_postcode` , `order_address` ) VALUES ('$lfjuid' , '$postdb[order_username]' , '$postdb[order_phone]' , '$postdb[order_mobphone]' , '$postdb[order_email]' , '$postdb[order_qq]' , '$postdb[order_postcode]' , '$postdb[order_address]')"); } } ``` /shop/join.php中 ``` if($action=="postnew") { //自定义字段的合法检查与数据处理 $Module_db->checkpost($field_db,$postdb,''); join_post();//此函数取出入库数据 unset($id_array); foreach($listdb AS $uid=>$array){ $totalmoney = 0; $detail=''; foreach($array AS $_rs){ $totalmoney+=$_rs[price]*$p_totalArray[$_rs[id]]; $detail[] = "$_rs[id]={$p_totalArray[$_rs[id]]}"; } $products = addslashes( implode(',',$detail) ); $rs=$db->get_one("SELECT * FROM `{$pre}purse` WHERE uid='$uid'"); $parray=unserialize($rs[config]); if($postdb[order_sendtype]==2){//平邮 $totalmoney+=floatval($parray[slow_send]); }elseif($postdb[order_sendtype]==3){//快递 $totalmoney+=floatval($parray[norm_send]); }elseif($postdb[order_sendtype]==4){//EMS $totalmoney+=floatval($parray[ems_send]); } //$totalmoney = number_format($totalmoney,2); /*往主信息表插入内容*/ $db->query("INSERT INTO `{$_pre}join` ( `mid` , `cid` , `cuid` , `posttime` , `uid` , `username` , `yz` , `ip` , `totalmoney`,`products`) VALUES ( '$mid' , '$_rs[id]' , '$uid', '$timestamp','$lfjdb[uid]','$lfjdb[username]','0','$onlineip','$totalmoney','$products')"); $id = $id_array[] = $db->insert_id(); unset($sqldb); $sqldb[]="id='$id'"; $sqldb[]="uid='$lfjuid'"; /*检查判断辅信息表要插入哪些字段的内容*/ foreach( $field_db AS $key=>$value){ isset($postdb[$key]) && $sqldb[]="`{$key}`='{$postdb[$key]}'"; } $sql=implode(",",$sqldb); $db->query("INSERT INTO `{$_pre}content_$mid` SET $sql");//数据入库产生注入 ``` ### 漏洞证明： 估计是我的Mysql 注册版本太低，不能报错注入，http://www.tongyuxian.com/shop/此网站躺抢 首先注册一个个人用户，访问http://www.tongyuxian.com/shop//member/address.php?job=postnew [<img src="https://images.seebug.org/upload/201411/0507464754a037c359f4aae46f11e4cfea185ae2.jpg" alt="vv.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0507464754a037c359f4aae46f11e4cfea185ae2.jpg) 然后购买商品，结算，使用存在的地址。 [<img src="https://images.seebug.org/upload/201411/0507475474fd52d05907d0365ed79fb2eaf906ae.jpg" alt="bb.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0507475474fd52d05907d0365ed79fb2eaf906ae.jpg) [<img src="https://images.seebug.org/upload/201411/050749372fa44f1a125dfede72576b0ecf4e2bb0.jpg" alt="mm.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/050749372fa44f1a125dfede72576b0ecf4e2bb0.jpg)