齐博CMS 二次注入2

### 简要描述： 奇博门户v5.0 二次注入 ### 详细说明： shop\member\address.php ``` elseif($action=="postnew"){ $db->query("INSERT INTO `{$_pre}address` (`uid` ,`order_username` ,`order_phone` ,`order_mobphone` ,`order_email` ,`order_qq` ,`order_postcode` ,`order_address` ) VALUES ('$lfjuid', '$order_username', '$order_phone', '$order_mobphone', '$order_email', '$order_qq', '$order_postcode', '$order_address')"); refreshto("?job=list",'',0); }elseif($action=="edit"){ checkrid($rid); $db->query("UPDATE `{$_pre}address` SET order_username='$order_username',order_phone='$order_phone',order_email='$order_email',order_qq='$order_qq',order_postcode='$order_postcode',order_address='$order_address',order_mobphone='$order_mobphone' WHERE rid='$rid'"); refreshto("?job=list",'',0); } ``` 这个地方数据插入表qb_shop_address，来看数据表字段 [<img src="https://images.seebug.org/upload/201411/0511413357632f8c86d5301504aec080ce7b082e.jpg" alt="qbb.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0511413357632f8c86d5301504aec080ce7b082e.jpg) 也就是order_emaill,order_address比较大点，应该能够插入足够的数据。 \shop\join.php中 ``` if($action=="postnew") { //自定义字段的合法检查与数据处理 $Module_db->checkpost($field_db,$postdb,''); join_post();//此函数判断使用新地址还是旧地址，此处使用旧地址，也就是出库的地方。 unset($id_array); foreach($listdb AS $uid=>$array){ $totalmoney = 0; $detail=''; foreach($array AS $_rs){ $totalmoney+=$_rs[price]*$p_totalArray[$_rs[id]]; $detail[] = "$_rs[id]={$p_totalArray[$_rs[id]]}"; } $products = addslashes( implode(',',$detail) ); $rs=$db->get_one("SELECT * FROM `{$pre}purse` WHERE uid='$uid'"); $parray=unserialize($rs[config]); if($postdb[order_sendtype]==2){ //平邮 $totalmoney+=floatval($parray[slow_send]); }elseif($postdb[order_sendtype]==3){ //快递 $totalmoney+=floatval($parray[norm_send]); }elseif($postdb[order_sendtype]==4){ //EMS $totalmoney+=floatval($parray[ems_send]); } //$totalmoney = number_format($totalmoney,2); /*往主信息表插入内容*/ $db->query("INSERT INTO `{$_pre}join` ( `mid` , `cid` , `cuid` , `posttime` , `uid` , `username` , `yz` , `ip` , `totalmoney`,`products`) VALUES ( '$mid' , '$_rs[id]' , '$uid', '$timestamp','$lfjdb[uid]','$lfjdb[username]','0','$onlineip','$totalmoney','$products')"); $id = $id_array[] = $db->insert_id(); unset($sqldb); $sqldb[]="id='$id'"; $sqldb[]="uid='$lfjuid'"; /*检查判断辅信息表要插入哪些字段的内容*/ foreach( $field_db AS $key=>$value){//在$field_db中存在的数组$key,并且在$postdb中同样存在$key的进行赋值成为$sqldb isset($postdb[$key]) && $sqldb[]="`{$key}`='{$postdb[$key]}'";//$postdb[$key]添加单引号 } $sql=implode(",",$sqldb);//将数组中添加","号 $db->query("INSERT INTO `{$_pre}content_$mid` SET $sql");//入库 ``` 截取到此处入库的操作语句为 ``` INSERT INTO `qb_shop_content_2` SET id='39',uid='39',`order_paytype`='1',`order_address`='jkk',`content`='',`order_phone`='jjj',`order_username`='test2',`order_mobphone`='jjj',`order_email`='1'... ``` 字段order_address在order_emaill之前，所以要在order_address处set order_emaill的值 如果表qb_shop_content_2中的字段够长并且属于同样类型则ok了，来看字段信息。 [<img src="https://images.seebug.org/upload/201411/051220184796d511d9edc77c2bb04a20b6fe1691.jpg" alt="qbccJPG.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/051220184796d511d9edc77c2bb04a20b6fe1691.jpg) 字段符合，长度够大. ### 漏洞证明： 此网站躺抢 http://www.tongyuxian.com/shop/member/address.php?job=postnew 添加新地址，保存。 [<img src="https://images.seebug.org/upload/201411/05122750e3747b3589a6e0fe70f38f3d7ca907d2.jpg" alt="t1.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/05122750e3747b3589a6e0fe70f38f3d7ca907d2.jpg) 购买商品，并使用此地址。 然后访问个人主页中的控制面板，商城系统，我购买的订单，查看订单详情 [<img src="https://images.seebug.org/upload/201411/05132924e9867c3ceee12a61ca04bda06027f335.jpg" alt="ty2.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/05132924e9867c3ceee12a61ca04bda06027f335.jpg)

elseif($action=="postnew"){
    $db->query("INSERT INTO `{$_pre}address` (`uid` ,`order_username` ,`order_phone` ,`order_mobphone` ,`order_email` ,`order_qq` ,`order_postcode` ,`order_address` ) VALUES ('$lfjuid', '$order_username', '$order_phone', '$order_mobphone', '$order_email', '$order_qq', '$order_postcode', '$order_address')");
    refreshto("?job=list",'',0);
}elseif($action=="edit"){
    checkrid($rid);
    $db->query("UPDATE `{$_pre}address` SET order_username='$order_username',order_phone='$order_phone',order_email='$order_email',order_qq='$order_qq',order_postcode='$order_postcode',order_address='$order_address',order_mobphone='$order_mobphone' WHERE rid='$rid'");
    refreshto("?job=list",'',0);
}

if($action=="postnew")
{
    //自定义字段的合法检查与数据处理
    $Module_db->checkpost($field_db,$postdb,'');
    join_post();//此函数判断使用新地址还是旧地址，此处使用旧地址，也就是出库的地方。
    unset($id_array);
    foreach($listdb AS $uid=>$array){
        $totalmoney = 0;
        $detail='';
        foreach($array AS $_rs){
            $totalmoney+=$_rs[price]*$p_totalArray[$_rs[id]];
            $detail[] = "$_rs[id]={$p_totalArray[$_rs[id]]}";
        }
        $products = addslashes( implode(',',$detail) );
        $rs=$db->get_one("SELECT * FROM `{$pre}purse` WHERE uid='$uid'");
        $parray=unserialize($rs[config]);

        if($postdb[order_sendtype]==2){            //平邮
            $totalmoney+=floatval($parray[slow_send]);
        }elseif($postdb[order_sendtype]==3){    //快递
            $totalmoney+=floatval($parray[norm_send]);
        }elseif($postdb[order_sendtype]==4){    //EMS
            $totalmoney+=floatval($parray[ems_send]);
        }
        //$totalmoney = number_format($totalmoney,2);
        /*往主信息表插入内容*/
        $db->query("INSERT INTO `{$_pre}join` ( `mid` , `cid` , `cuid` ,  `posttime` ,  `uid` , `username` , `yz` , `ip` ,  `totalmoney`,`products`) 
        VALUES (
        '$mid' , '$_rs[id]' , '$uid', '$timestamp','$lfjdb[uid]','$lfjdb[username]','0','$onlineip','$totalmoney','$products')");
        $id = $id_array[] = $db->insert_id();
        unset($sqldb);
        $sqldb[]="id='$id'";
        $sqldb[]="uid='$lfjuid'";

        /*检查判断辅信息表要插入哪些字段的内容*/
        foreach( $field_db AS $key=>$value){//在$field_db中存在的数组$key,并且在$postdb中同样存在$key的进行赋值成为$sqldb
            isset($postdb[$key]) && $sqldb[]="`{$key}`='{$postdb[$key]}'";//$postdb[$key]添加单引号
        }
        $sql=implode(",",$sqldb);//将数组中添加","号
        $db->query("INSERT INTO `{$_pre}content_$mid` SET $sql");//入库

INSERT INTO `qb_shop_content_2` SET id='39',uid='39',`order_paytype`='1',`order_address`='jkk',`content`='',`order_phone`='jjj',`order_username`='test2',`order_mobphone`='jjj',`order_email`='1'...