### 简要描述：
三处sql注射打包
### 详细说明：
\virtual-office\offer.php:
```
if (isset($_POST['del']) && !empty($_POST['tradeid'])) {
$tRes = $trade->del($_POST['tradeid'], "member_id = ".$the_memberid);
if($tRes) $pdb->Execute("DELETE from {$tb_prefix}tradefields WHERE member_id={$the_memberid} AND trade_id IN (".implode(",",$_POST['tradeid']).")");//注入1:没有过滤，也没有引号保护，直接进入sql语句
}
if(isset($_POST['refresh'])){
if (!empty($_POST['refresh']) && !empty($_POST['tradeid'])) {
$vals = array();
$pre_submittime = $pdb->GetOne("select max(submit_time) from {$tb_prefix}trades where member_id=".$the_memberid);
if ($pre_submittime>($time_stamp-$tMaxDay*86400)) {
flash("allow_refresh_day");
}
$vals['submit_time'] = $time_stamp;
$vals['expire_days'] = 10;
$vals['expire_time'] = $time_stamp+(24*3600*$vals['expire_days']);
$conditions[]= "status='1'";
$ids = implode(",", $_POST['tradeid']);//注入2 ，同上
$conditions[]= "id in (".$ids.")";
$condition = implode(" AND ", $conditions);
$sql = "update ".$trade->getTable()." set submit_time=".$time_stamp.",expire_days=10,expire_time=".$vals['expire_time']." where ".$condition;
$result = $pdb->Execute($sql);
if ($result) {
flash("success");
}else{
flash("action_failed");
}
}
}
```
\virtual-office\link.php:
```
if (isset($_POST['delete'])) {
$deleted = false;
if (is_array($_POST['id'])) { //注入3
$ids = "(".implode(",", $_POST['id']).")"; //也没有引号保护
$deleted = $pdb->Execute("DELETE FROM {$tb_prefix}spacelinks WHERE member_id={$the_memberid} AND id IN $ids");
if($deleted){
flash("success");
}else{
flash();
}
}else{
flash("no_data_deleted");
}
}
```
### 漏洞证明：
注册企业会员，发布供求信息，然后删除:
[<img src="https://images.seebug.org/upload/201501/21144106a7b9caa5fd4707a33fbf0302d1e7d483.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/21144106a7b9caa5fd4707a33fbf0302d1e7d483.png)
sql日志:
[<img src="https://images.seebug.org/upload/201501/2114412932ba6708ef539ee53f55341b6916ee48.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2114412932ba6708ef539ee53f55341b6916ee48.png)
注入二:
[<img src="https://images.seebug.org/upload/201501/21144150a618e856a1ad4afe7106641fc8898e98.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/21144150a618e856a1ad4afe7106641fc8898e98.png)
sql日志:
[<img src="https://images.seebug.org/upload/201501/2114502728aa6a8712b2e4864e448e7034b64457.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2114502728aa6a8712b2e4864e448e7034b64457.png)
第三处注入:
添加合作伙伴，然后删除：
http://localhost/phpb2b/virtual-office/link.php?do=edit
[<img src="https://images.seebug.org/upload/201501/2114455153ee946abd2a4f9e1d6eb8ffd5fbc129.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2114455153ee946abd2a4f9e1d6eb8ffd5fbc129.png)
sql日志:
[<img src="https://images.seebug.org/upload/201501/21144606c94aa8363ffb4e94fb062a3a519d15ef.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/21144606c94aa8363ffb4e94fb062a3a519d15ef.png)
京公网安备 11010502034610号
暂无评论