PHPCMS全版本通杀SQL注入漏洞下载

PHPCMS全版本通杀SQL注入漏洞通杀v9的SQL注入,包括最新v9.5.3版本

总的来说，是因为你们修复不完善，并没有理解到这个SQL注入的真正原因,同时 补丁后 并没有进行相应的测试 因而可绕过补丁 继续注入...



#漏洞分析

首先看下面的代码

/phpcms/modules/member/content.php 202行 edit函数

 

public function edit() {

	$_username = $this->memberinfo['username'];

	if(isset($_POST['dosubmit'])) {

		$catid = $_POST['info']['catid'] = intval($_POST['info']['catid']);

		$siteids = getcache('category_content', 'commons');

		$siteid = $siteids[$catid];

		$CATEGORYS = getcache('category_content_'.$siteid, 'commons');

		$category = $CATEGORYS[$catid];

		if($category['type']==0) {//审核状态时，点编辑 再提交，进入if分支

			$id = intval($_POST['id']);

			$catid = $_POST['info']['catid'] = intval($_POST['info']['catid']);

			$this->content_db = pc_base::load_model('content_model');

			$modelid = $category['modelid'];

			$this->content_db->set_model($modelid);

			//判断会员组投稿是否需要审核

			$memberinfo = $this->memberinfo;

			$grouplist = getcache('grouplist');

			$setting = string2array($category['setting']);

			if(!$grouplist[$memberinfo['groupid']]['allowpostverify'] || $setting['workflowid']) {

				$_POST['info']['status'] = 1;

			}

			$info = array();

			foreach($_POST['info'] as $_k=>$_v) {

				if(in_array($_k, $fields)) $_POST['info'][$_k] = new_html_special_chars(trim_script($_v));

			}



			$_POST['linkurl'] = str_replace(array('"','(',')',",",' '),'',new_html_special_chars($_POST['linkurl']));

			//exit(print_r($_POST['info']));

			$this->content_db->edit_content($_POST['info'],$id);

			$forward = $_POST['forward'];

			showmessage(L('update_success'),$forward);

		}

	} else {

		//...

}

229行

 

$this->content_db->edit_content($_POST['info'],$id);

其中 $_POST['info'] 参数是一个数组，其内容是在线投稿的各项内容，如图所示

好了，接下来我们看看这些数据都经过了怎样的处理...

跟上edit_content函数

/phpcms/model/content_model.class.php 第234行开始

 

public function edit_content($data,$id) {

		$model_tablename = $this->model_tablename;

		//前台权限判断

		if(!defined('IN_ADMIN')) {

			$_username = param::get_cookie('_username');

			$us = $this->get_one(array('id'=>$id,'username'=>$_username));

			if(!$us) return false;

		}



		$this->search_db = pc_base::load_model('search_model');



		require_once CACHE_MODEL_PATH.'content_input.class.php';

        require_once CACHE_MODEL_PATH.'content_update.class.php';

		$content_input = new content_input($this->modelid);

		$inputinfo = $content_input->get($data);//跟进此函数

		// /caches/caches_model/caches_data/content_input.class.php get函数



		$systeminfo = $inputinfo['system'];

第248行，我们可以看到 $_POST['info'] 数组进入了 get 函数，继续跟进

/caches/caches_model/caches_data/content_input.class.php 第55行开始

 

if($pattern && $length && !preg_match($pattern, $value) && !$isimport) showmessage($errortips);

$MODEL = getcache('model', 'commons');

$this->db->table_name = $this->fields[$field]['issystem'] ? $this->db_pre.$MODEL[$this->modelid]['tablename'] : $this->db_pre.$MODEL[$this->modelid]['tablename'].'_data';

if($this->fields[$field]['isunique'] && $this->db->get_one(array($field=>$value),$field) && ROUTE_A != 'edit') showmessage($name.L('the_value_must_not_repeat'));

$func = $this->fields[$field]['formtype'];

if(method_exists($this, $func)) $value = $this->$func($field, $value);//这里是关键,后面慢慢说明

if($this->fields[$field]['issystem']) {

	$info['system'][$field] = $value;

} else {

	$info['model'][$field] = $value;

}

我们重点关注这里是怎么处理的

 

if(method_exists($this, $func)) $value = $this->$func($field, $value);

为了方便看清楚程序在这里究竟是怎样处理的,我们在这行代码前面加入以下调试代码，看看都经过了哪些函数的处理...

 

if($pattern && $length && !preg_match($pattern, $value) && !$isimport) showmessage($errortips);

$MODEL = getcache('model', 'commons');

$this->db->table_name = $this->fields[$field]['issystem'] ? $this->db_pre.$MODEL[$this->modelid]['tablename'] : $this->db_pre.$MODEL[$this->modelid]['tablename'].'_data';

if($this->fields[$field]['isunique'] && $this->db->get_one(array($field=>$value),$field) && ROUTE_A != 'edit') showmessage($name.L('the_value_must_not_repeat'));

$func = $this->fields[$field]['formtype'];

echo "<br>Function :-->".$func."<--<br>";//这是添加的调试代码

if(method_exists($this, $func)) $value = $this->$func($field, $value);//这里是关键,后面慢慢说明

if($this->fields[$field]['issystem']) {

	$info['system'][$field] = $value;

} else {

	$info['model'][$field] = $value;

}