CmsEasy最新版SQL注入可获取管理员账户

CmsEasy最新版SQL注入可获取管理员账户 - 网站安全

来源：自学PHP网时间：2015-04-15 15:00 作者：阅读:次

[导读] 与： CmsEasy最新版本无限制SQL注射:http: www 2cto com Article 201407 313603 html 重复:CmsEasy_5 5_UTF-8_20140420官方最新包文件 lib default archive_act php在提交订单时：function orders_action()...

与： CmsEasy最新版本无限制SQL注射:http://www.2cto.com/Article/201407/313603.html 重复:

CmsEasy_5.5_UTF-8_20140420

官方最新包

文件/lib/default/archive_act.php

在提交订单时：

function orders_action() {

        $this->view->aid = trim(front::get('aid'));

        if (front::post('submit')) {

         $this->orders = new orders();

         $row = $this->orders->getrow("","adddate DESC");

         //var_dump(time());

         if($row['adddate'] && time() - $row['adddate'] <= intval(config::get('order_time'))){

         alerterror('操作频繁,请稍后再试');

         return;

         }

            if (front::$post['telphone'] == '') {

                alerterror('联系电话为必填！');

                return;

            }

            front::$post['mid'] = $this->view->user['userid'] ? $this->view->user['userid'] : 0;

            front::$post['adddate'] = time();

            front::$post['ip'] = front::ip();

            if (isset(front::$post['aid'])) {

                $aidarr = front::$post['aid'];

                unset(front::$post['aid']);

                foreach ($aidarr as $val) {

                    front::$post['aid'].=$val . ',';

                    front::$post['pnums'].=front::$post['thisnum'][$val] . ',';

                }

            } else {

                front::$post['aid'] = $this->view->aid;

            }

            if (!isset(front::$post['logisticsid']))

                front::$post['logisticsid'] = 0;

            front::$post['oid'] = date('YmdHis') . '-' . front::$post['logisticsid'] . '-' . front::$post['mid'] . '-' . front::$post['payname'];

            

            $insert = $this->orders->rec_insert(front::$post);

            if ($insert < 1) {

                front::flash($this->tname . lang('添加失败！'));

            } else {

             if (config::get('sms_on') && config::get('sms_order_on')) {

             sendMsg(front::$post['telphone'], config::get('sms_order'));

             }

             if (config::get('sms_on') && config::get('sms_order_admin_on') && $mobile = config::get('site_mobile')) {

             sendMsg($mobile, '网站在' . date('Y-m-d H:i:s') . '有新订单了');

             //echo 11;

             }

             $user = $this->view->user;

             if(config::get('email_order_send_cust') && $user['e_mail']){

             $title = "您在".config::get('sitename')."的订单".front::get('oid')."已提交";

             $this->sendmail($user['e_mail'], $title, $title);

             }

             if(config::get('email_order_send_admin') && config::get('email')){

             $title = '网站在' . date('Y-m-d H:i:s') . '有新订单了';

             $this->sendmail(config::get('email'), $title, $title);

             }

                if (front::$post['payname'] && front::$post['payname'] != 'nopay') {

                    

                    echo '<script type="text/javascript">alert("' . lang('orderssuccess') . ' ' . lang('现在转入支付页面') . '");window.location.href="' . url('archive/payorders/oid/' . front::$post['oid'], true) . '";</script>';

                }

                echo '<script type="text/javascript">alert("' . lang('orderssuccess') . '");window.location.href="' . url('archive/orders/oid/' . front::$post['oid'], true) . '";</script>';

            }


front::$post['ip'] = front::ip();

我们来看看这里的ip()函数：

static function ip() {

        if ($_SERVER['HTTP_CLIENT_IP']) {

            $onlineip = $_SERVER['HTTP_CLIENT_IP'];

        }

        elseif ($_SERVER['HTTP_X_FORWARDED_FOR']) {

            $onlineip = $_SERVER['HTTP_X_FORWARDED_FOR'];

        }

        elseif ($_SERVER['REMOTE_ADDR']) {

            $onlineip = $_SERVER['REMOTE_ADDR'];

        }

        else {

            $onlineip = $_SERVER['REMOTE_ADDR'];

        }

if(config::get('ipcheck_enable')){

if(!preg_match('/^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/', $onlineip)&&!preg_match('@^\s*((([0-9A-Fa-f]{1,4}:){7}(([0-9A-Fa-f]{1,4})|:))|(([0-9A-Fa-f]{1,4}:){6}(:|((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})|(:[0-9A-Fa-f]{1,4})))|(([0-9A-Fa-f]{1,4}:){5}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){4}(:[0-9A-Fa-f]{1,4}){0,1}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){3}(:[0-9A-Fa-f]{1,4}){0,2}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){2}(:[0-9A-Fa-f]{1,4}){0,3}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:)(:[0-9A-Fa-f]{1,4}){0,4}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(:(:[0-9A-Fa-f]{1,4}){0,5}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})))(%.+)?\s*$@', $onlineip)){

exit('来源非法');

}

}

        return $onlineip;

    }

这里的正则存在问题，最后一句的(%.+)，这里我们在IP后面加上%，然后就能跟上任意内容

那么我们使用1.1.1.1%xxx就能绕过正则进行注入了。

漏洞证明：

第一步

首先添加一件物品