### 简要描述：
### 详细说明：
上个注入大礼包，终于走了一个大厂商！
看来还是打包来的划算，最后一个注入大礼包了。
这个漏洞完了，回给出修复方案，求给力！
第一处SQL注入
/app/group/action/add.php
```
// 执行发布帖子
case "do" :
if ($_POST ['token'] != $_SESSION ['token']) {
tsNotice ( '非法操作！' );
}
$authcode = strtolower ( $_POST ['authcode'] );
if ($TS_SITE ['base'] ['isauthcode']) {
if ($authcode != $_SESSION ['verify']) {
tsNotice ( "验证码输入有误，请重新输入！" );
}
}
$groupid = intval ( $_POST ['groupid'] );
$title = tsClean ( $_POST ['title'] );
$content = tsClean ( $_POST ['content'] );
$typeid = intval ( $_POST ['typeid'] );
$tag = tsClean ( $_POST ['tag'] );
......
// 处理@用户名
if (preg_match_all ( '/@/', $content, $at )) {
preg_match_all ( "/@(.+?)([\s|:]|$)/is", $content, $matches );
$unames = $matches [1];
$ns = "'" . implode ( "','", $unames ) . "'";
$csql = "username IN($ns)";
if ($unames) {
$query = $db->fetch_all_assoc ( "select userid,username from " . dbprefix . "user_info where $csql" );
```
这里在进行发帖时，内容可以@别人，但是在匹配@内容时，content内容由函数tsClean()过滤，同样没有到的过滤SQL的功能。没有任何处理，进行了sql查询语句，导致SQL注入。
第二处SQL注入
/app/group/action/add.php
```
// 处理@用户名
if (preg_match_all ( '/@/', $content, $at )) {
preg_match_all ( "/@(.+?)([\s|:]|$)/is", $content, $matches );
$unames = $matches [1];
$ns = "'" . implode ( "','", $unames ) . "'";
$csql = "username IN($ns)";
if ($unames) {
$query = $db->fetch_all_assoc ( "select userid,username from " . dbprefix . "user_info where $csql" );
foreach ( $query as $v ) {
$content = str_replace ( '@' . $v ['username'] . '', '[@' . $v ['username'] . ':' . $v ['userid'] . ']', $content );
$msg_content = '我在帖子中提到了你<br />去看看：' . tsUrl ( 'group', 'topic', array (
'id' => $topicid
) );
aac ( 'message' )->sendmsg ( $userid, $v ['userid'], $msg_content );
}
$new ['group']->update ( 'group_topic', array (
'topicid' => $topicid
), array (
'content' => $content
) );
}
```
也是在第一处SQL注入的下面，进行了update操作，同样content没有过滤进入update的row参数，没过滤导致注入。
如图证明：
[<img src="https://images.seebug.org/upload/201402/24173900afd7ddd656cb2709c637ee220d14d521.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/24173900afd7ddd656cb2709c637ee220d14d521.png)
第三处SQL注入
/app/group/action/after.php
```
//执行补贴
case "ado":
if($_POST['token'] != $_SESSION['token']) {
tsNotice('非法操作！');
}
$topicid = intval($_POST['topicid']);
$content = tsClean($_POST['content']);
$title = tsClean($_POST['title']);
......
//上传附件开始
$attUpload = tsUpload($_FILES['attfile'],$afterid,'after',array('zip','rar','doc','txt','pdf','ppt','docx','xls','xlsx'));
if($attUpload){
$new['group']->update('group_topic_add',array(
'id'=>$afterid,
),array(
'path'=>$attUpload['path'],
'attach'=>$attUpload['url'],
'attachname'=>$attUpload['name'],
));
}
//上传附件结束
```
执行补贴时，上传附件时，对上传文件的名字那么没有过滤，导致SQL注入。
第四+五处SQL注入
/app/group/action/after.php
```
//编辑执行
case "edo":
if($_POST['token'] != $_SESSION['token']) {
tsNotice('非法操作！');
}
$afterid = intval($_POST['afterid']);
$strAfter = $new['group']->find('group_topic_add',array(
'id'=>$afterid,
));
if($strAfter['userid'] == $userid || $TS_USER['user']['isadmin']==1){
$content = tsClean($_POST['content']);
$title = tsClean($_POST['title']);
//过滤内容开始
aac('system')->antiWord($title);
aac('system')->antiWord($content);
//过滤内容结束
$new['group']->update('group_topic_add',array(
'id'=>$afterid,
),array(
'title'=>$title,
'content'=>$content,
'uptime'=>time(),
));
......
//上传附件开始
$attUpload = tsUpload($_FILES['attfile'],$afterid,'after',array('zip','rar','doc','txt','pdf','ppt','docx','xls','xlsx'));
if($attUpload){
$new['group']->update('group_topic_add',array(
'id'=>$afterid,
),array(
'path'=>$attUpload['path'],
'attach'=>$attUpload['url'],
'attachname'=>$attUpload['name'],
));
```
这里存在两处，一处是编辑发布的补贴内容时，title和content都没有过滤，导致SQL注入。
还有一处就是编辑补贴时上传附件，附件的名字那么未过滤，导致SQL注入。
证明如图：
[<img src="https://images.seebug.org/upload/201402/24174009f3dfa2624c0caa2cebba323841f6effb.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/24174009f3dfa2624c0caa2cebba323841f6effb.png)
### 漏洞证明：
见详细说明
京公网安备 11010502034610号
暂无评论