### 简要描述：
Sql Injection
### 详细说明：
注入在XDCMS企业管理系统后台的模型发布处，\system\modules\xdcms\model.php文件：
管理员在发布模型和编辑模型的时候会分别调用model_add_save()和model_edit_save()函数，三个注入点就出现在这两个函数里：
model_add_save()函数：
```
public function model_add_save(){
$modelname=safe_html($_POST['modelname']);//safe_html可被大写绕过
$modeltable=$_POST['modeltable'];//未过滤，直接注入
$modeltable_content=get_content_table($modeltable);
$is_lock=$_POST['is_lock'];
$is_fixed=$_POST['is_fixed'];
if(empty($modelname)||empty($modeltable)){
showmsg(C('material_not_complete'),'-1');
}
if(!check_str($modeltable,'/^[a-z0-9][a-z0-9]*$/')){
showmsg(C('table').C('numbers_and_letters'),'-1');
}
$tables=$this->mysql->show_table();
if(in_array(DB_PRE.$modeltable,$tables)){
showmsg(C('table_exist'),'-1');
}
if(in_array(DB_PRE.$modeltable_content,$tables)){
showmsg(C('table_exist'),'-1');
}
$this->mysql->db_insert('model',"`model_name`='".$modelname."',`model_table`='".$modeltable."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed);
$field="`id` int(8) unsigned NOT NULL AUTO_INCREMENT,`catid` tinyint(5) unsigned NOT NULL DEFAULT '0',`title` char(80) NOT NULL,`thumb` char(100) NOT NULL,`keywords` char(40) NOT NULL,`description` char(255) NOT NULL,`commend` tinyint(1) unsigned NOT NULL DEFAULT '0',`url` char(100) NOT NULL,`userid` mediumint(8) unsigned NOT NULL DEFAULT '0',`username` char(20) NOT NULL,`inputtime` int(10) unsigned NOT NULL DEFAULT '0',`updatetime` int(10) unsigned NOT NULL DEFAULT '0',`hits` int(8) unsigned NOT NULL DEFAULT '0',`sort` int(8) unsigned NOT NULL DEFAULT '0',`style` char(20) default NULL,PRIMARY KEY (`id`)";
$field_content="id int(8) not null,PRIMARY KEY (`id`)";
$this->mysql->create_table($modeltable,$field);
$this->mysql->create_table($modeltable_content,$field_content);
$this->cache->model_cache();
showmsg(C('add_success'),'-1');
}
```
model_edit_save()函数：
```
public function model_edit_save(){
$id=isset($_POST['id'])?intval($_POST['id']):0;
$modelname=safe_html($_POST['modelname']);//可大写绕过
$is_lock=$_POST['is_lock'];
$is_fixed=isset($_POST['is_fixed'])?intval($_POST['is_fixed']):1;
if(empty($modelname)){
showmsg(C('material_not_complete'),'-1');
}
$this->mysql->db_update("model","`model_name`='".$modelname."',`is_lock`=".$is_lock.",`is_fixed`=".$is_fixed."","`id`=".$id);
$this->cache->model_cache();
showmsg(C('update_success'),'-1');
}
```
### 漏洞证明：
添加模型处以modelname为例，点击模型添加：
[<img src="https://images.seebug.org/upload/201402/18145003c9b5eb26b08a1db9537110cc927e8f1d.jpg" alt="xb.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145003c9b5eb26b08a1db9537110cc927e8f1d.jpg)
抓包添加exp：
[<img src="https://images.seebug.org/upload/201402/18145043658c23ffdf4bbf6e63c91ca9df2fc52f.jpg" alt="xb1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145043658c23ffdf4bbf6e63c91ca9df2fc52f.jpg)
成功：
[<img src="https://images.seebug.org/upload/201402/181451484ba8afd1063642945b75c38591a6ecf1.jpg" alt="xb2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/181451484ba8afd1063642945b75c38591a6ecf1.jpg)
管理模型处modelname，点击编辑：
[<img src="https://images.seebug.org/upload/201402/1814525814cebc6297042a8343c9c004c2630c13.jpg" alt="xb5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/1814525814cebc6297042a8343c9c004c2630c13.jpg)
抓包加exp：
[<img src="https://images.seebug.org/upload/201402/18145317f91b0b657642e81a0d52a4cc5389126b.jpg" alt="xb6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145317f91b0b657642e81a0d52a4cc5389126b.jpg)
成功：
[<img src="https://images.seebug.org/upload/201402/18145332e76aefe7b0e845d55290de0e1c74526c.jpg" alt="xb3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/18145332e76aefe7b0e845d55290de0e1c74526c.jpg)
京公网安备 11010502034610号
暂无评论