### 简要描述： Sql Injection ### 详细说明： 注入在XDCMS企业管理系统后台的模型发布处，\system\modules\xdcms\model.php文件： 管理员在发布模型和编辑模型的时候会分别调用model_add_save()和model_edit_save()函数，三个注入点就出现在这两个函数里： model_add_save()函数： ``` public function model_add_save(){ $modelname=safe_html($_POST['modelname']);//safe_html可被大写绕过 $modeltable=$_POST['modeltable'];//未过滤，直接注入 $modeltable_content=get_content_table($modeltable); $is_lock=$_POST['is_lock']; $is_fixed=$_POST['is_fixed']; if(empty($modelname)||empty($modeltable)){ showmsg(C('material_not_complete'),'-1'); } if(!check_str($modeltable,'/^[a-z0-9][a-z0-9]*$/')){ showmsg(C('table').C('numbers_and_letters'),'-1'); } $tables=$this->mysql->show_table(); if(in_array(DB_PRE.$modeltable,$tables)){ showmsg(C('table_exist'),'-1'); } if(in_array(DB_PRE.$modeltable_content,$tables)){ showmsg(C('table_exist'),'-1'); } $this->mysql->db_insert('model',"`model_name`='".$modelname."',`model_table`='".$modeltable."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed); $field="`id` int(8)...
### 简要描述： Sql Injection ### 详细说明： 注入在XDCMS企业管理系统后台的模型发布处，\system\modules\xdcms\model.php文件： 管理员在发布模型和编辑模型的时候会分别调用model_add_save()和model_edit_save()函数，三个注入点就出现在这两个函数里： model_add_save()函数： ``` public function model_add_save(){ $modelname=safe_html($_POST['modelname']);//safe_html可被大写绕过 $modeltable=$_POST['modeltable'];//未过滤，直接注入 $modeltable_content=get_content_table($modeltable); $is_lock=$_POST['is_lock']; $is_fixed=$_POST['is_fixed']; if(empty($modelname)||empty($modeltable)){ showmsg(C('material_not_complete'),'-1'); } if(!check_str($modeltable,'/^[a-z0-9][a-z0-9]*$/')){ showmsg(C('table').C('numbers_and_letters'),'-1'); } $tables=$this->mysql->show_table(); if(in_array(DB_PRE.$modeltable,$tables)){ showmsg(C('table_exist'),'-1'); } if(in_array(DB_PRE.$modeltable_content,$tables)){ showmsg(C('table_exist'),'-1'); } $this->mysql->db_insert('model',"`model_name`='".$modelname."',`model_table`='".$modeltable."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed); $field="`id` int(8) unsigned NOT NULL AUTO_INCREMENT,`catid` tinyint(5) unsigned NOT NULL DEFAULT '0',`title` char(80) NOT NULL,`thumb` char(100) NOT NULL,`keywords` char(40) NOT NULL,`description` char(255) NOT NULL,`commend` tinyint(1) unsigned NOT NULL DEFAULT '0',`url` char(100) NOT NULL,`userid` mediumint(8) unsigned NOT NULL DEFAULT '0',`username` char(20) NOT NULL,`inputtime` int(10) unsigned NOT NULL DEFAULT '0',`updatetime` int(10) unsigned NOT NULL DEFAULT '0',`hits` int(8) unsigned NOT NULL DEFAULT '0',`sort` int(8) unsigned NOT NULL DEFAULT '0',`style` char(20) default NULL,PRIMARY KEY (`id`)"; $field_content="id int(8) not null,PRIMARY KEY (`id`)"; $this->mysql->create_table($modeltable,$field); $this->mysql->create_table($modeltable_content,$field_content); $this->cache->model_cache(); showmsg(C('add_success'),'-1'); } ``` model_edit_save()函数： ``` public function model_edit_save(){ $id=isset($_POST['id'])?intval($_POST['id']):0; $modelname=safe_html($_POST['modelname']);//可大写绕过 $is_lock=$_POST['is_lock']; $is_fixed=isset($_POST['is_fixed'])?intval($_POST['is_fixed']):1; if(empty($modelname)){ showmsg(C('material_not_complete'),'-1'); } $this->mysql->db_update("model","`model_name`='".$modelname."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed."","`id`=".$id); $this->cache->model_cache(); showmsg(C('update_success'),'-1'); } ``` ### 漏洞证明： 添加模型处以modelname为例，点击模型添加： [<img src="https://images.seebug.org/upload/201402/18145003c9b5eb26b08a1db9537110cc927e8f1d.jpg" alt="xb.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145003c9b5eb26b08a1db9537110cc927e8f1d.jpg) 抓包添加exp： [<img src="https://images.seebug.org/upload/201402/18145043658c23ffdf4bbf6e63c91ca9df2fc52f.jpg" alt="xb1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145043658c23ffdf4bbf6e63c91ca9df2fc52f.jpg) 成功： [<img src="https://images.seebug.org/upload/201402/181451484ba8afd1063642945b75c38591a6ecf1.jpg" alt="xb2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/181451484ba8afd1063642945b75c38591a6ecf1.jpg) 管理模型处modelname，点击编辑： [<img src="https://images.seebug.org/upload/201402/1814525814cebc6297042a8343c9c004c2630c13.jpg" alt="xb5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/1814525814cebc6297042a8343c9c004c2630c13.jpg) 抓包加exp： [<img src="https://images.seebug.org/upload/201402/18145317f91b0b657642e81a0d52a4cc5389126b.jpg" alt="xb6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145317f91b0b657642e81a0d52a4cc5389126b.jpg) 成功： [<img src="https://images.seebug.org/upload/201402/18145332e76aefe7b0e845d55290de0e1c74526c.jpg" alt="xb3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145332e76aefe7b0e845d55290de0e1c74526c.jpg)
