### 简要描述：
ThinkSAAS 最新版2.1，官方2月15日更新，SQL注入第一弹
### 详细说明：
文件/app/photo/action/album.php
```
//批量修改执行
case "info_do":
//用户是否登录
$userid = aac('user')->isLogin();
$albumid = intval($_POST['albumid']);
$albumface = tsClean($_POST['albumface']);//进行了过滤，但未过滤完全
$arrPhotoId = intval($_POST['photoid']);
$arrPhotoDesc = $_POST['photodesc'];
if($TS_USER['user']['isadmin']==0){
foreach($arrPhotoDesc as $key=>$item){
//过滤内容开始
aac('system')->antiWord($item);
//过滤内容结束
}
}
foreach($arrPhotoDesc as $key=>$item){
if($item){
$photoid = intval($arrPhotoId[$key]);
$new['photo']->update('photo',array(
'photoid'=>$photoid,
),array(
'photodesc'=>tsClean($item),
));
}
}
//更新相册封面
if($albumface){
$new['photo']->update('photo_album',array(
'userid'=>$userid,
'albumid'=>$albumid,
),array(
'albumface'=>$albumface,//带入数据库查询导致SQL注入
));
}
header("Location: ".tsUrl('photo','album',array('id'=>$albumid)));
break;
```
虽然进行了tsClean过滤，但是我们来看看函数：
```
function tsClean($text) {
$text = cleanJs ( $text );
return $text;
}
/**
* 过滤脚本代码
* @param unknown $text
* @return mixed
*/
function cleanJs($text) {
$text = trim ( $text );
$text = stripslashes ( $text );
// 完全过滤注释
$text = preg_replace ( '/<!--?.*-->/', '', $text );
// 完全过滤动态代码
$text = preg_replace ( '/<\?|\?>/', '', $text );
// 完全过滤js
$text = preg_replace ( '/<script?.*\/script>/', '', $text );
// 过滤多余html
$text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text );
// 过滤on事件lang js
while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) {
$text = str_replace ( $mat [0], $mat [1], $text );
}
while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) {
$text = str_replace ( $mat [0], $mat [1] . $mat [3], $text );
}
return $text;
}
```
只是用来过滤js代码。
再来看看update的处理：
```
public function update($table, $conditions, $row) {
$where = "";
if (empty ( $row ))
return FALSE;
if (is_array ( $conditions )) {
$join = array ();
foreach ( $conditions as $key => $condition ) {
$condition = $this->escape ( $condition );
$join [] = "{$key} = {$condition}";
}
$where = "WHERE " . join ( " AND ", $join );
} else {
if (null != $conditions)
$where = "WHERE " . $conditions;
}
foreach ( $row as $key => $value ) {
$vals [] = "`$key` = '$value'";
}
$values = join ( ", ", $vals );
$sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}";
return $this->db->query ( $sql );
}
```
虽然在conditions处做了转义但是在row处没有处理，这里正好在row处，导致SQL注入。
### 漏洞证明：
构造请求如图，即可：
[<img src="https://images.seebug.org/upload/201402/200922131f3b2ca6d677161953dc9cf30f929b83.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/200922131f3b2ca6d677161953dc9cf30f929b83.png)
京公网安备 11010502034610号
暂无评论