当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0144446

漏洞标题:贷齐乐p2p全局问题多处注入(无视gpc/waf)

相关厂商:chinaanhe.com

漏洞作者: Xser

提交时间:2015-10-02 08:31

修复时间:2016-01-11 15:32

公开时间:2016-01-11 15:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-02: 细节已通知厂商并且等待厂商处理中
2015-10-02: 厂商已经确认,细节仅向厂商公开
2015-10-05: 细节向第三方安全合作伙伴开放(绿盟科技唐朝安全巡航
2015-11-26: 细节向核心白帽子及相关领域专家公开
2015-12-06: 细节向普通白帽子公开
2015-12-16: 细节向实习白帽子公开
2016-01-11: 细节向公众公开

简要描述:

RT

详细说明:

出现在upload文件上

if ($error==""){
$sql = "insert into `{upfiles}` set code='{$data['code']}',aid='{$data['aid']}',user_id='{$data['user_id']}',`name`='{$_name}',filesize='{$_FILES[$file]['size'][$i]}',filetype='{$this->img_type}',fileurl='".$this->file_dir.$newFile."',filename='".$newFile."',`addtime` = '".time()."', `updatetime` = '".time()."',`addip` = '".ip_address()."',`updateip` = '".ip_address()."'";
$mysql ->db_query($sql);
$upfiles_id = $mysql->db_insert_id();
$_result[$i]['filename'] = $this->file_dir.$newFile;
$_result[$i]['upfiles_id'] = $upfiles_id;
}else{
echo "<script>alert('".$err_var[$error]."');history.go(-1);</script>";
exit;
}
}


可以看到文件名没有验证然后带入sql查询
跟踪下在哪里调用了
在module/user/user.inc.php中

/实名认证
elseif ($_U['query_type'] == "realname"){
if (isset($_POST['realname'])){
$var = array("realname","sex","card_type","card_id","province","city","province","city","area","nation");
$data = post_var($var);
$data['user_id'] = $_G['user_id'];
$data['birthday'] = get_mktime($_POST['birthday']);
$data['real_status'] = 2;

$result = userClass::CheckIdcard(array("user_id"=>$data['user_id'],"card_id"=>$data['card_id']));
if(!isIdCard($data['card_id'])){
$msg = array("身份证号码格式不正确","","?user&q=code/user/realname");
}elseif($result == true){
$msg = array("身份证号码已经存在","","?user&q=code/user/realname");
}else{
$_G['upimg']['file'] = "card_pic2";
$_G['upimg']['code'] = "user";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic2'] = $pic_result['filename'];
}
$_G['upimg']['file'] = "card_pic1";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic1'] = $pic_result['filename'];
}
$result = $user->UpdateUserAll($data);
if ($result == false){
$msg = array($result);
}else{
$msg = array("姓名认证添加成功,请等待管理员审核","",$url);
}
}
}


实名认证那里

$_G['upimg']['file'] = "card_pic1";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic1'] = $pic_result['filename'];
}
$result = $user->UpdateUserAll($data);


因为是FILE数组所以不受gpc/waf
我们测试下带入单引号
http://127.0.0.1/index.php?user&q=code/user/realname

360截图20151001215202384.jpg


抓包修改提交,看看报错

360截图20151001220216497.jpg

漏洞证明:

出现在upload文件上

if ($error==""){
$sql = "insert into `{upfiles}` set code='{$data['code']}',aid='{$data['aid']}',user_id='{$data['user_id']}',`name`='{$_name}',filesize='{$_FILES[$file]['size'][$i]}',filetype='{$this->img_type}',fileurl='".$this->file_dir.$newFile."',filename='".$newFile."',`addtime` = '".time()."', `updatetime` = '".time()."',`addip` = '".ip_address()."',`updateip` = '".ip_address()."'";
$mysql ->db_query($sql);
$upfiles_id = $mysql->db_insert_id();
$_result[$i]['filename'] = $this->file_dir.$newFile;
$_result[$i]['upfiles_id'] = $upfiles_id;
}else{
echo "<script>alert('".$err_var[$error]."');history.go(-1);</script>";
exit;
}
}


可以看到文件名没有验证然后带入sql查询
跟踪下在哪里调用了
在module/user/user.inc.php中

/实名认证
elseif ($_U['query_type'] == "realname"){
if (isset($_POST['realname'])){
$var = array("realname","sex","card_type","card_id","province","city","province","city","area","nation");
$data = post_var($var);
$data['user_id'] = $_G['user_id'];
$data['birthday'] = get_mktime($_POST['birthday']);
$data['real_status'] = 2;

$result = userClass::CheckIdcard(array("user_id"=>$data['user_id'],"card_id"=>$data['card_id']));
if(!isIdCard($data['card_id'])){
$msg = array("身份证号码格式不正确","","?user&q=code/user/realname");
}elseif($result == true){
$msg = array("身份证号码已经存在","","?user&q=code/user/realname");
}else{
$_G['upimg']['file'] = "card_pic2";
$_G['upimg']['code'] = "user";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic2'] = $pic_result['filename'];
}
$_G['upimg']['file'] = "card_pic1";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic1'] = $pic_result['filename'];
}
$result = $user->UpdateUserAll($data);
if ($result == false){
$msg = array($result);
}else{
$msg = array("姓名认证添加成功,请等待管理员审核","",$url);
}
}
}


实名认证那里

$_G['upimg']['file'] = "card_pic1";
$pic_result = $upload->upfile($_G['upimg']);
if ($pic_result!=""){
$data['card_pic1'] = $pic_result['filename'];
}
$result = $user->UpdateUserAll($data);


因为是FILE数组所以不受gpc/waf
我们测试下带入单引号
http://127.0.0.1/index.php?user&q=code/user/realname

360截图20151001215202384.jpg


抓包修改提交,看看报错

360截图20151001220216497.jpg

修复方案:

版权声明:转载请注明来源 Xser@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2015-10-02 11:12

厂商回复:

请官方认真审核,此并非贷齐乐正版漏洞,应该是贷齐乐盗版或者是贷齐乐1.0版,看界面就是很古老的版本,请不要以贷齐乐冠名,贷齐乐身份上传已经早就不这样写了

最新状态:

暂无


漏洞评价:

评价

  1. 2015-10-03 20:27 | 岛云首席鉴黄师 ( 普通白帽子 | Rank:430 漏洞数:123 | icisaw.cn 超低价虚拟主机VPS 购买返现 支...)

    贷齐乐1.0版不是你们的?

  2. 2015-10-06 10:18 | secgov ( 路人 | Rank:10 漏洞数:3 | 安全审计,漏洞挖掘,WAF. 提醒大家揭露漏洞...)

    态度决定命运

  3. 2015-10-09 15:14 | 小良 ( 路人 | Rank:8 漏洞数:2 | 根本不会挖漏洞~)

    @岛云首席鉴黄师 贷齐乐1.0确实不是他们的,他们盗版的别人的~

  4. 2015-10-10 02:12 | 岛云首席鉴黄师 ( 普通白帽子 | Rank:430 漏洞数:123 | icisaw.cn 超低价虚拟主机VPS 购买返现 支...)

    @小良 soga~看来也是个二逼厂商……

  5. 2015-10-11 16:36 | Xser ( 普通白帽子 | Rank:365 漏洞数:83 | JDSec)

    其实我想说这个是你们的2.1商业版本。。。。。