dedecms /include/helpers/archive.helper.php SQL Injection Vul

時間 2019-11-10

標籤 dedecms include helpers archive.helper.php archive helper php sql injection vul 欄目 CMS 简体版

原文原文鏈接

catalogphp

1. 漏洞描述
2. 漏洞觸發條件
3. 漏洞影響範圍
4. 漏洞代碼分析
5. 防護方法
6. 攻防思考

1. 漏洞描述sql

Dedecms會員中心注入漏洞函數

Relevant Link:post

http://www.wooyun.org/bugs/wooyun-2010-048892

2. 漏洞觸發條件spa

1. 打開http://127.0.0.1/dedecms5.7/member/soft_add.php
2. 添加軟件
3. 打開BURP抓包
    1) 將picnum改爲typeid2
    2) 而後參數寫5',1,1,1,@`'`),('-1','7',user() , '3','1389688643', '1389688643', '8'),(1,2,'

3. 漏洞影響範圍
4. 漏洞代碼分析code

/include/helpers/archive.helper.phpblog

if ( ! function_exists('GetIndexKey')) 
{ 
    function GetIndexKey($arcrank, $typeid, $sortrank=0, $channelid=1, $senddate=0, $mid=1) 
    { 
        //$typeid2來自外部，結合DEDE的本地變量覆蓋漏洞便可修改這個變量值
        global $dsql,$senddate,$typeid2;  
        
        if(empty($typeid2)) $typeid2 = 0; 
        if(empty($senddate)) $senddate = time(); 
        if(empty($sortrank)) $sortrank = $senddate;
        
        //$typeid二、$senddate未進行有效過濾就帶入SQL查詢
        $iquery = "
        INSERT INTO `#@__arctiny` (`arcrank`,`typeid`,`typeid2`,`channel`,`senddate`, `sortrank`, `mid`) 
        VALUES ('$arcrank','$typeid','$typeid2' , '$channelid','$senddate', '$sortrank', '$mid') ";
        
        echo    $iquery;

        $dsql->ExecuteNoneQuery($iquery); 
        $aid = $dsql->GetLastID(); 
        return $aid; 
    } 
}

/archive.helper.php是一個輔助函數庫，是存在漏洞的源頭，真正的漏洞攻擊向量由調用這個文件的GetIndexKey函數觸發
/member/soft_add.php
ip

else if($dopost=='save')
{
    $description = '';
    include(DEDEMEMBER.'/inc/archives_check.php');

    //生成文檔ID
    $arcID = GetIndexKey($arcrank,$typeid,$sortrank,$channelid,$senddate,$mid);
..

Relevant Link:文檔

http://www.wooyun.org/bugs/wooyun-2010-048892

5. 防護方法it

/include/helpers/archive.helper.php

if ( ! function_exists('GetIndexKey'))
{
    function GetIndexKey($arcrank, $typeid, $sortrank=0, $channelid=1, $senddate=0, $mid=1)
    {
        //$typeid2來自外部，結合DEDE的本地變量覆蓋漏洞便可修改這個變量值
        global $dsql,$senddate,$typeid2;
        if(empty($typeid2)) $typeid2 = 0;
        if(empty($senddate)) $senddate = time();
        if(empty($sortrank)) $sortrank = $senddate;
        /* 過濾 */
        $typeid2 = intval($typeid2);
        $senddate = intval($senddate);
        /* */
        $iquery = "
          INSERT INTO `#@__arctiny` (`arcrank`,`typeid`,`typeid2`,`channel`,`senddate`, `sortrank`, `mid`)
          VALUES ('$arcrank','$typeid','$typeid2' , '$channelid','$senddate', '$sortrank', '$mid') ";
        $dsql->ExecuteNoneQuery($iquery);
        $aid = $dsql->GetLastID();
        return $aid;
    }
}