### 漏洞相关文件
#### 1. /ajax.php
```
if($_REQUEST['act']=='count_buy_total')
{
require_once APP_ROOT_PATH."system/libs/cart.php";
$region_id = intval($_REQUEST['region_id']); //配送地区
$delivery_id = intval($_REQUEST['delivery_id']); //配送方式
$account_money = floatval($_REQUEST['account_money']); //余额
$ecvsn = $_REQUEST['ecvsn']?$_REQUEST['ecvsn']:'';
$ecvpassword = $_REQUEST['ecvpassword']?$_REQUEST['ecvpassword']:'';
$payment = intval($_REQUEST['payment']);
$all_account_money = intval($_REQUEST['all_account_money']);
$user_id = intval($GLOBALS['user_info']['id']);
$session_id = session_id();
$goods_list = $GLOBALS['db']->getAll("select * from ".DB_PREFIX."deal_cart where session_id='".$session_id."' and user_id=".$user_id);
$result = count_buy_total($region_id,$delivery_id,$payment,$account_money,$all_account_money,$ecvsn,$ecvpassword,$goods_list);
$GLOBALS['tmpl']->assign("result",$result);
$html = $GLOBALS['tmpl']->fetch("inc/cart/cart_total.html");
$data = $result;
$data['html'] = $html;
ajax_return($data);
}
```
文件中红色处看到ecvsn变量和 ecvpassword 变量均是外部获取的，表示可控。而后带入了count_buy_total 函数中，count_buy_total函数的定义在：
#### 2. \system\libs\cart.php
```
function count_buy_total($region_id,$delivery_id,$payment,$account_money,$all_account_money,$ecvsn,$ecvpassword,$goods_list,$paid_account_money = 0,$paid_ecv_money = 0)
{
//获取商品总价
//计算运费
$pay_price = 0; //支付总价
$total_price = 0;
$total_weight = 0;
$return_total_score = 0;
$return_total_money = 0;
$is_delivery = 0;
foreach($goods_list as $k=>$v)
{
$total_price += $v['total_price'];
$deal_info = $GLOBALS['db']->getRow("select * from ".DB_PREFIX."deal where id = ".$v['deal_id']);
if($deal_info['is_delivery'] == 1) //需要配送叠加重量
{
$deal_weight = floatval($deal_info['weight']); //团购商品的单位重量
$deal_weight_unit = $GLOBALS['db']->getRowCached("select * from ".DB_PREFIX."weight_unit where id = ".$deal_info['weight_id']); //团购的重单单价
$deal_weight = $deal_weight * $deal_weight_unit['rate']; //转换为为1的重量
$total_weight += ($deal_weight*$v['number']);
$is_delivery = 1;
}
$return_total_money = $return_total_money + $deal_info['return_money'] * $v['number'];
$return_total_score = $return_total_score + $deal_info['return_score'] * $v['number'];
}
$region_info = $GLOBALS['db']->getRowCached("select * from ".DB_PREFIX."delivery_region where id = ".intval($region_id));
$delivery_info = $GLOBALS['db']->getRowCached("select * from ".DB_PREFIX."delivery where id = ".intval($delivery_id));
$delivery_fee = count_delivery_fee($total_weight,$region_id, intval($delivery_info['id']));
$pay_price = $total_price + $delivery_fee; //加上运费
$pay_price = $pay_price - $paid_account_money - $paid_ecv_money;
//先计算用户等级折扣
$user_id = intval($GLOBALS['user_info']['id']);
$group_info = $GLOBALS['db']->getRow("select g.* from ".DB_PREFIX."user as u left join ".DB_PREFIX."user_group as g on u.group_id = g.id where u.id = ".$user_id);
if($group_info&&$total_price>0)
$user_discount = $total_price * (1-floatval($group_info['discount']));
else
$user_discount = 0;
$pay_price = $pay_price - $user_discount; //扣除用户折扣
//余额支付
$user_money = $GLOBALS['db']->getOne("select money from ".DB_PREFIX."user where id = ".$user_id);
if($all_account_money == 1)
{
$account_money = $user_money;
}
if($account_money>$user_money)
$account_money = $user_money; //余额支付量不能超过帐户余额
//开始计算代金券
$now = get_gmtime();
$ecv_sql = "select e.* from ".DB_PREFIX."ecv as e left join ".
DB_PREFIX."ecv_type as et on e.ecv_type_id = et.id where e.sn = '".
$ecvsn."' and e.password = '".
$ecvpassword."' and ((e.begin_time <> 0 and e.begin_time < ".$now.") or e.begin_time = 0) and ".
"((e.end_time <> 0 and e.end_time > ".$now.") or e.end_time = 0) and ((e.use_limit <> 0 and e.use_limit > e.use_count) or (e.use_limit = 0)) ".
"and (e.user_id = ".$user_id." or e.user_id = 0)";
$ecv_data = $GLOBALS['db']->getRow($ecv_sql);
$ecv_money = $ecv_data['money'];
```
在最后处看到ecv_sql的语句包含了之前的ecvsn变量，且没有经过任何过滤，之后就带入了数据库进行取值，直接导致了SQL注入漏洞。
共 2 兑换了
京公网安备 11010502034610号
暂无评论