### 简要描述： ### 详细说明： 上个注入大礼包，终于走了一个大厂商！ 看来还是打包来的划算，最后一个注入大礼包了。 这个漏洞完了，回给出修复方案，求给力！ 第一处SQL注入 /app/group/action/add.php ``` // 执行发布帖子 case "do" : if ($_POST ['token'] != $_SESSION ['token']) { tsNotice ( '非法操作！' ); } $authcode = strtolower ( $_POST ['authcode'] ); if ($TS_SITE ['base'] ['isauthcode']) { if ($authcode != $_SESSION ['verify']) { tsNotice ( "验证码输入有误，请重新输入！" ); } } $groupid = intval ( $_POST ['groupid'] ); $title = tsClean ( $_POST ['title'] ); $content = tsClean ( $_POST ['content'] ); $typeid = intval ( $_POST ['typeid'] ); $tag = tsClean ( $_POST ['tag'] ); ...... // 处理@用户名 if (preg_match_all ( '/@/', $content, $at )) { preg_match_all ( "/@(.+?)([\s|:]|$)/is", $content, $matches ); $unames = $matches [1]; $ns = "'" . implode ( "','", $unames ) . "'"; $csql = "username IN($ns)"; if ($unames) { $query = $db->fetch_all_assoc ( "select userid,username from " . dbprefix . "user_info where $csql" ); ```...
### 简要描述： ### 详细说明： 上个注入大礼包，终于走了一个大厂商！ 看来还是打包来的划算，最后一个注入大礼包了。 这个漏洞完了，回给出修复方案，求给力！ 第一处SQL注入 /app/group/action/add.php ``` // 执行发布帖子 case "do" : if ($_POST ['token'] != $_SESSION ['token']) { tsNotice ( '非法操作！' ); } $authcode = strtolower ( $_POST ['authcode'] ); if ($TS_SITE ['base'] ['isauthcode']) { if ($authcode != $_SESSION ['verify']) { tsNotice ( "验证码输入有误，请重新输入！" ); } } $groupid = intval ( $_POST ['groupid'] ); $title = tsClean ( $_POST ['title'] ); $content = tsClean ( $_POST ['content'] ); $typeid = intval ( $_POST ['typeid'] ); $tag = tsClean ( $_POST ['tag'] ); ...... // 处理@用户名 if (preg_match_all ( '/@/', $content, $at )) { preg_match_all ( "/@(.+?)([\s|:]|$)/is", $content, $matches ); $unames = $matches [1]; $ns = "'" . implode ( "','", $unames ) . "'"; $csql = "username IN($ns)"; if ($unames) { $query = $db->fetch_all_assoc ( "select userid,username from " . dbprefix . "user_info where $csql" ); ``` 这里在进行发帖时，内容可以@别人，但是在匹配@内容时，content内容由函数tsClean()过滤，同样没有到的过滤SQL的功能。没有任何处理，进行了sql查询语句，导致SQL注入。 第二处SQL注入 /app/group/action/add.php ``` // 处理@用户名 if (preg_match_all ( '/@/', $content, $at )) { preg_match_all ( "/@(.+?)([\s|:]|$)/is", $content, $matches ); $unames = $matches [1]; $ns = "'" . implode ( "','", $unames ) . "'"; $csql = "username IN($ns)"; if ($unames) { $query = $db->fetch_all_assoc ( "select userid,username from " . dbprefix . "user_info where $csql" ); foreach ( $query as $v ) { $content = str_replace ( '@' . $v ['username'] . '', '[@' . $v ['username'] . ':' . $v ['userid'] . ']', $content ); $msg_content = '我在帖子中提到了你<br />去看看：' . tsUrl ( 'group', 'topic', array ( 'id' => $topicid ) ); aac ( 'message' )->sendmsg ( $userid, $v ['userid'], $msg_content ); } $new ['group']->update ( 'group_topic', array ( 'topicid' => $topicid ), array ( 'content' => $content ) ); } ``` 也是在第一处SQL注入的下面，进行了update操作，同样content没有过滤进入update的row参数，没过滤导致注入。 如图证明： [<img src="https://images.seebug.org/upload/201402/24173900afd7ddd656cb2709c637ee220d14d521.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/24173900afd7ddd656cb2709c637ee220d14d521.png) 第三处SQL注入 /app/group/action/after.php ``` //执行补贴 case "ado": if($_POST['token'] != $_SESSION['token']) { tsNotice('非法操作！'); } $topicid = intval($_POST['topicid']); $content = tsClean($_POST['content']); $title = tsClean($_POST['title']); ...... //上传附件开始 $attUpload = tsUpload($_FILES['attfile'],$afterid,'after',array('zip','rar','doc','txt','pdf','ppt','docx','xls','xlsx')); if($attUpload){ $new['group']->update('group_topic_add',array( 'id'=>$afterid, ),array( 'path'=>$attUpload['path'], 'attach'=>$attUpload['url'], 'attachname'=>$attUpload['name'], )); } //上传附件结束 ``` 执行补贴时，上传附件时，对上传文件的名字那么没有过滤，导致SQL注入。 第四+五处SQL注入 /app/group/action/after.php ``` //编辑执行 case "edo": if($_POST['token'] != $_SESSION['token']) { tsNotice('非法操作！'); } $afterid = intval($_POST['afterid']); $strAfter = $new['group']->find('group_topic_add',array( 'id'=>$afterid, )); if($strAfter['userid'] == $userid || $TS_USER['user']['isadmin']==1){ $content = tsClean($_POST['content']); $title = tsClean($_POST['title']); //过滤内容开始 aac('system')->antiWord($title); aac('system')->antiWord($content); //过滤内容结束 $new['group']->update('group_topic_add',array( 'id'=>$afterid, ),array( 'title'=>$title, 'content'=>$content, 'uptime'=>time(), )); ...... //上传附件开始 $attUpload = tsUpload($_FILES['attfile'],$afterid,'after',array('zip','rar','doc','txt','pdf','ppt','docx','xls','xlsx')); if($attUpload){ $new['group']->update('group_topic_add',array( 'id'=>$afterid, ),array( 'path'=>$attUpload['path'], 'attach'=>$attUpload['url'], 'attachname'=>$attUpload['name'], )); ``` 这里存在两处，一处是编辑发布的补贴内容时，title和content都没有过滤，导致SQL注入。 还有一处就是编辑补贴时上传附件，附件的名字那么未过滤，导致SQL注入。 证明如图： [<img src="https://images.seebug.org/upload/201402/24174009f3dfa2624c0caa2cebba323841f6effb.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/24174009f3dfa2624c0caa2cebba323841f6effb.png) ### 漏洞证明： 见详细说明
