VULHUB ™

### 简要描述： RT ### 详细说明： 文件：\userinfo.php ``` include_once("kernel/eidolon.class.php"); $eidolon=new Eidolon("templets/userinfo.html"); include_once("kernel/member.class.php"); $member=new Member(); if($res=$member->searchByName($_GET["username"],0,"")) { foreach($res as $v) { extract($v,EXTR_OVERWRITE); } } $eidolon->parseBlock("_main"); $eidolon->showBlock("_main"); ``` ``` $res=$member->searchByName($_GET["username"],0,"")) ``` 传递到searchByName中，然后跟中member.class.php文件中 ``` function searchByName($key,$mo,$order) { $where=""; $where.=($this->role_id>0)?" AND role_id=".($this->role_id - 1):""; $where.=($this->mg_id>0)? " AND members.mg_id=".$this->mg_id:""; if($order!="member_name" && $order !="member_reg_date" && $order != "member_log_date" && $order != "role_id") { $order="member_id"; } if($key=="") { $sql= "SELECT * FROM members LEFT JOIN member_groups ON members.mg_id=member_groups.mg_id WHERE 1=1 ".$where." ORDER BY '".$order."' DESC LIMIT ".$this->getLimit();; } else if($mo==1)...

### 简要描述： RT ### 详细说明： 文件：\userinfo.php ``` include_once("kernel/eidolon.class.php"); $eidolon=new Eidolon("templets/userinfo.html"); include_once("kernel/member.class.php"); $member=new Member(); if($res=$member->searchByName($_GET["username"],0,"")) { foreach($res as $v) { extract($v,EXTR_OVERWRITE); } } $eidolon->parseBlock("_main"); $eidolon->showBlock("_main"); ``` ``` $res=$member->searchByName($_GET["username"],0,"")) ``` 传递到searchByName中，然后跟中member.class.php文件中 ``` function searchByName($key,$mo,$order) { $where=""; $where.=($this->role_id>0)?" AND role_id=".($this->role_id - 1):""; $where.=($this->mg_id>0)? " AND members.mg_id=".$this->mg_id:""; if($order!="member_name" && $order !="member_reg_date" && $order != "member_log_date" && $order != "role_id") { $order="member_id"; } if($key=="") { $sql= "SELECT * FROM members LEFT JOIN member_groups ON members.mg_id=member_groups.mg_id WHERE 1=1 ".$where." ORDER BY '".$order."' DESC LIMIT ".$this->getLimit();; } else if($mo==1) { $sql= "SELECT * FROM members LEFT JOIN member_groups ON members.mg_id=member_groups.mg_id WHERE member_name LIKE '%".$key."%' ".$where." ORDER BY '".$order."' DESC LIMIT ".$this->getLimit();; } else { $sql="SELECT * FROM members LEFT JOIN member_groups ON members.mg_id=member_groups.mg_id WHERE member_name='".$key."' ".$where." ORDER BY '".$order."' DESC LIMIT ".$this->getLimit(); }//echo $sql; return $this->find($sql); } ``` ``` $sql="SELECT * FROM members LEFT JOIN member_groups ON members.mg_id=member_groups.mg_id WHERE member_name='".$key."' ".$where." ORDER BY '".$order."' DESC LIMIT ".$this->getLimit(); ``` 可以看到为经过处理带入到$key函数中直接查询。 ### 漏洞证明： 官网测试站点：http://218.75.75.92/userinfo.php?username=zaizai（注意这里需要登录才能注册） 抓包： ``` GET /userinfo.php?username=zaizai HTTP/1.1 Host: 218.75.75.92 Proxy-Connection: keep-alive Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36 Accept-Encoding: gzip,deflate,sdch Accept-Language: zh-CN,zh;q=0.8 Cookie: PHPSESSID=4dec0dc3125003fc97364110a3e142eb ``` 比较懒啊，直接丢入sqlmap中跑就可以了。 [<img src="https://images.seebug.org/upload/201408/061702483aadded02765d2a6525061dbfe177f2f.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/061702483aadded02765d2a6525061dbfe177f2f.jpg) [<img src="https://images.seebug.org/upload/201408/061704384efdac474e547639236158a77dc60da1.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/061704384efdac474e547639236158a77dc60da1.jpg) 不继续跑了啊。