### `ShopBuilder`简介
* `ShopBuilder`是专为大中型企业开发的专业级`电子商务商城系统`，功能强大，安全便捷，可承载千万级访问量，让企业低成本快速构建在线商城，开启电子商务业务，系统开源发售，可以根据公司业务需要，制定专门的业务流程和各种功能模块，已成为大中型企业做电商的必选产品。
### 漏洞原理
* 参数未经严格过滤，直接被带入至`SQL`语句中进行查询，导致注入漏洞的产生
### 漏洞分析
* 第一处`SQL`注入：
* 查看`module\adv\admin\adv.php`文件
```
if($_GET['delid'])
{
$sql="delete from ".ADVSCON." where id='$_GET[delid]'";
$db->query($sql);
unset($_GET['delid']);
unset($_GET['s']);
unset($_GET['m']);
$getstr=implode('&',convert($_GET));
msg("?m=adv&s=adv.php&$getstr");
}
if($_POST['act']=='op')
{
if($_POST['chk'])
{
$id=implode(",",$_POST['chk']);
$sql="delete from ".ADVSCON." where ID in ($id)";
$db->query($sql);
$getstr=implode('&',convert($_GET));
msg("?m=adv&s=adv.php&$getstr");
}
}
$sql="select ID,`name` from ".ADVS." order by id ";
$db->query($sql);
$re=$db->getRows();
$tpl->assign("re",$re);
```
* 分析上面代码段：
```
$id=implode(",",$_POST['chk']);
$sql="delete from ".ADVSCON." where ID in ($id)";
```
* `$id`无`单引号保护`直接被带入`SQL`语句中进行查询，导致注入漏洞的产生
* 第二处`SQL`注入：
* 查看`module\adv\admin\audit.php`文件
```
include_once("../includes/page_utf_class.php");
//==========================================
if(!empty($_POST["action"])&&$_POST["action"]==lang_show('delete'))
{
if(isset($_POST["de"]) && is_array($_POST["de"]))
{
$id=implode(",",$_POST["de"]);
if($id)
$db->query("update ".ADVSCON." set statu='-2' where id in ($id) and statu=-1");
}
}
```
* 注入点分析同第一处`SQL`注入
* 第三处`SQL`注入：
* 查看`\module\announcement\admin\announcement.php`文件
```
else
{
//删除公告
if($_GET['delid'])
{
$db->query("delete from ".ANNOUNCEMENT." where id='$_GET[delid]'");
unset($_GET['delid']);
unset($_GET['s']);
unset($_GET['m']);
$getstr=implode('&',convert($_GET));
msg("?m=announcement&s=announcement.php&$getstr");
}
if($_POST['act']=='op')
{
if(is_array($_POST['chk']))
{
$id=implode(",",$_POST['chk']);
$sql="delete from ".ANNOUNCEMENT." where id in ($id)";
$db->query($sql);
foreach($_POST['chk'] as $list)
{
$db->query("update ".PRO." set promotion_id=0 where promotion_id='$list'");
}
}
if($_POST['displayorder'])
{
foreach($_POST['displayorder'] as $key=>$list)
{
$db->query("update ".ANNOUNCEMENT." set displayorder='$list' where id='$key'");
}
}
msg("?m=announcement&s=announcement.php");
}
```
* 注入点分析同第一次`SQL`注入
* 第四处`SQL`注入：
* 查看`module\brand\admin\brand_cat.php`文件
```
if($_POST['act']=='op')
{
if($_POST['submit']==$lang['btn_submit'])
{
if(is_array($_POST['chk']))
{
$id=implode(",",$_POST['chk']);
$sql="delete from ".BRANDCAT." where id in ($id)";
$db->query($sql);
$sql="delete from ".BRANDCAT." where parent_id in ($id)";
$db->query($sql);
}
if($_POST['displayorder'])
{
foreach($_POST['displayorder'] as $key=>$list)
{
$db->query("update ".BRANDCAT." set displayorder='$list' where id='$key'");
}
}
}
msg("?m=brand&s=brand_cat.php");
}
```
* 注入点分析同第一处`SQL`注入
* 第五处`SQL`注入：
* 查看`module\brand\admin\brand.php`文件
```
if($_GET['delid'])
{
$sql="delete from ".BRAND." where id='$_GET[delid]'";
$db->query($sql);
unset($_GET['delid']);
unset($_GET['s']);
unset($_GET['m']);
msg("?m=brand&s=brand.php$getstr");
}
if($_POST['act']=='op')
{
if($_POST['submit']==$lang['btn_submit'])
{
if(is_array($_POST['chk']))
{
$id=implode(",",$_POST['chk']);
$sql="delete from ".BRAND." where id in ($id)";
$db->query($sql);
}
if($_POST['displayorder'])
{
foreach($_POST['displayorder'] as $key=>$list)
{
$db->query("update ".BRAND." set displayorder='$list' where id='$key'");
}
}
}
```
* 注入点分析同第一处`SQL`注入
### 漏洞修复
* 完善参数过滤措施
### 参考链接
* [http://www.wooyun.org/bugs/wooyun-2015-0112688](http://www.wooyun.org/bugs/wooyun-2015-0112688)
共 3 兑换了
京公网安备 11010502034610号
暂无评论