### 简要描述： ThinkSAAS 最新版2.1，官方2月15日更新，SQL注入第一弹 ### 详细说明： 文件/app/photo/action/album.php ``` //批量修改执行 case "info_do": //用户是否登录 $userid = aac('user')->isLogin(); $albumid = intval($_POST['albumid']); $albumface = tsClean($_POST['albumface']);//进行了过滤，但未过滤完全 $arrPhotoId = intval($_POST['photoid']); $arrPhotoDesc = $_POST['photodesc']; if($TS_USER['user']['isadmin']==0){ foreach($arrPhotoDesc as $key=>$item){ //过滤内容开始 aac('system')->antiWord($item); //过滤内容结束 } } foreach($arrPhotoDesc as $key=>$item){ if($item){ $photoid = intval($arrPhotoId[$key]); $new['photo']->update('photo',array( 'photoid'=>$photoid, ),array( 'photodesc'=>tsClean($item), )); } } //更新相册封面 if($albumface){ $new['photo']->update('photo_album',array( 'userid'=>$userid, 'albumid'=>$albumid, ),array( 'albumface'=>$albumface,//带入数据库查询导致SQL注入 )); } header("Location: ".tsUrl('photo','album',array('id'=>$albumid))); break; ``` 虽然进行了tsClean过滤，但是我们来看看函数： ``` function tsClean($text) { $text = cleanJs ( $text ); return $text; } /**...
### 简要描述： ThinkSAAS 最新版2.1，官方2月15日更新，SQL注入第一弹 ### 详细说明： 文件/app/photo/action/album.php ``` //批量修改执行 case "info_do": //用户是否登录 $userid = aac('user')->isLogin(); $albumid = intval($_POST['albumid']); $albumface = tsClean($_POST['albumface']);//进行了过滤，但未过滤完全 $arrPhotoId = intval($_POST['photoid']); $arrPhotoDesc = $_POST['photodesc']; if($TS_USER['user']['isadmin']==0){ foreach($arrPhotoDesc as $key=>$item){ //过滤内容开始 aac('system')->antiWord($item); //过滤内容结束 } } foreach($arrPhotoDesc as $key=>$item){ if($item){ $photoid = intval($arrPhotoId[$key]); $new['photo']->update('photo',array( 'photoid'=>$photoid, ),array( 'photodesc'=>tsClean($item), )); } } //更新相册封面 if($albumface){ $new['photo']->update('photo_album',array( 'userid'=>$userid, 'albumid'=>$albumid, ),array( 'albumface'=>$albumface,//带入数据库查询导致SQL注入 )); } header("Location: ".tsUrl('photo','album',array('id'=>$albumid))); break; ``` 虽然进行了tsClean过滤，但是我们来看看函数： ``` function tsClean($text) { $text = cleanJs ( $text ); return $text; } /** * 过滤脚本代码 * @param unknown $text * @return mixed */ function cleanJs($text) { $text = trim ( $text ); $text = stripslashes ( $text ); // 完全过滤注释 $text = preg_replace ( '/<!--?.*-->/', '', $text ); // 完全过滤动态代码 $text = preg_replace ( '/<\?|\?>/', '', $text ); // 完全过滤js $text = preg_replace ( '/<script?.*\/script>/', '', $text ); // 过滤多余html $text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text ); // 过滤on事件lang js while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1], $text ); } while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1] . $mat [3], $text ); } return $text; } ``` 只是用来过滤js代码。 再来看看update的处理： ``` public function update($table, $conditions, $row) { $where = ""; if (empty ( $row )) return FALSE; if (is_array ( $conditions )) { $join = array (); foreach ( $conditions as $key => $condition ) { $condition = $this->escape ( $condition ); $join [] = "{$key} = {$condition}"; } $where = "WHERE " . join ( " AND ", $join ); } else { if (null != $conditions) $where = "WHERE " . $conditions; } foreach ( $row as $key => $value ) { $vals [] = "`$key` = '$value'"; } $values = join ( ", ", $vals ); $sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}"; return $this->db->query ( $sql ); } ``` 虽然在conditions处做了转义但是在row处没有处理，这里正好在row处，导致SQL注入。 ### 漏洞证明： 构造请求如图，即可： [<img src="https://images.seebug.org/upload/201402/200922131f3b2ca6d677161953dc9cf30f929b83.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/200922131f3b2ca6d677161953dc9cf30f929b83.png)
