WooYun.org

#1 SQL注入漏洞
/3g/index.php

$AgentContent = $_SERVER['HTTP_USER_AGENT'];
$AcceptContent = $_SERVER['HTTP_ACCEPT'];
$time = date("Y-m-d H:i:s",time());
$insert = "insert into MobileInfoTable values(NULL,'$AgentContent','$AcceptContent','$time');";

其中$AgentContent，$AcceptContent 不受GPC限制造成SQL注入漏洞

$AgentContent = $_SERVER['HTTP_USER_AGENT'];
$AcceptContent = $_SERVER['HTTP_ACCEPT'];

证明：

#2 命令执行
/admin/configguide/ipsec_guide_1.php

function getifipmask($ethx,$ipstr,$maskstr,$macstr)
{
    unset($commandRet);
    exec("sudo /sbin/ifconfig $ethx | head -1 | awk '{print $5}'",$commandRet);
    //macaddr format 00:0C:29:17:AE:4B
    $macstr = $commandRet[0];
    unset($commandRet);
    exec("sudo /sbin/ifconfig $ethx | head -2 | awk '{NR==2} END{print $2}'",$commandRet);
    //ipaddr format:addr:192.168.1.126
    sscanf($commandRet[0],"addr:%s", $ipstr);
    unset($commandRet);
    exec("sudo /sbin/ifconfig $ethx | head -2 | awk '{NR==2} END{print $4}'",$commandRet);
    //mask  format:Mask:255.255.255.0
    sscanf($commandRet[0],"Mask:%s",$maskstr);
}

不多说 ：

#3 任意修改防火墙策略
/admin/add_fire_wall.php

这里也有 /admin/add_ikev2.php
#4 任意文件下载
/admin/cert_download.php

<?php
$filename = substr($file,strpos('certs/',$certfile)+6);
//文件的类型
header('Content-type: application/pdf');
//下载显示的名字
header('Content-Disposition: attachment; filename="'.$filename.'"');
readfile("$certfile");
exit();
?>

#5 N多SQL注入漏洞

/admin/config_Anticrack.php?GroupId=111
/admin/config_ISCGroupNoCache.php?GroupId=111
/admin/config_ISCGroupSSLCert.php?GroupId=111
/admin/config_ISCGroupTimePolicy.php

GroupId参数没有过滤造成SQL注入
选择其一证明：

#6其他SQL注入，太多了
SQL注入漏洞
/admin\config_MT.php?action=delete&Mid=1 Mid
/admin/count_host.php 该页多个参数存在注入漏洞 比如：主机名
/admin/count_user.php 该页多个参数存在注入漏洞 比如：用户名
/admin/edit_fire_wall.php?FireWallId=111 FireWallId参数
/admin/edit_user_login.php 该页面多个参数存在SQL注入漏洞
/admin/export_excel_user.php SQL注入漏洞
#7多个命令执行漏洞：
/admin/detail_tunel.php

passthru("/sbin/ipsec statusall |grep $tunnelname");
$temp1=explode("{",$tunnelname);
exec("/sbin/ipsec statusall | grep ".$temp1[0]."[{[]", $readStr);

太多了。。。
任意文件下载
/commonplugin/Download.php?reqfile=Download's filename
任意命令执行：
/commonplugin/DownloadWebCert.php
$conv = "/Isc/third-party/openssl/bin/openssl pkcs12 -export -in " . $CertFile . " -inkey " . $KeyFile . " -passin pass:" . $pass ." -passout pass:" . $pass . " -out " . $P12OutFile;
unset($result);
exec("sudo " . $conv, $result, $error);
其中pass参数可控
/commonplugin/getsysdatetime.php
if($changetime!="")
{
exec("sudo date -s '$changetime'");
exec("sudo /sbin/hwclock --systohc");
exec("sudo rm ../admin/drawpic/cpu.data ../admin/drawpic/cputime.data");
}
/debug/list_logfile.php 这个文件非常重要，但多个参数可造成任意命令执行
/debug/rproxy_diag.php 这个文件也有同样的问题
case "delete":
$count = count($logfile);
if($count <=0)
show_error("未选择操作数据行!");
for($i = 0; $i<$count; $i++)
{
$del = "sudo rm -f ".$logfile[$i];
system($del);
}
redirect("list_logfile.php");
break;
case "showlicense":
... ...
case "restartservice":
$command = "sudo /etc/init.d/".$bash." stop";
exec($command);
$command = "sudo /etc/init.d/".$bash." start";
exec($command);
redirect("list_logfile.php");
break;
case "advlogfalse":
任意命令执行
/debug/show_logfile.php
exec("sudo cat $filename",$read); //filename可控
SQL注入
/WebPages/applyhardware.php 多个参数存在SQL注入
/WebPages/applyhardware.php?action=applyhardware&hard_user=%2527 (双编码即可)
/WebPages/history.php uid参数SQL注入
$query="select SessionId from ISCOnLineUser where SessionId=$uid";
/WebPages/singlelogin.php 多个参数SQL注入
如：/WebPages/singlelogin.php?submit=1&loginid=11'