phpyun v3.2 (20141226) 两处注入。

发表于 2014年12月29日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2014-088872

漏洞标题：phpyun v3.2 (20141226) 两处注入。

漏洞详情

披露状态：

2014-12-29: 细节已通知厂商并且等待厂商处理中
2014-12-29: 厂商已经确认，细节仅向厂商公开
2015-01-01: 细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航、无声信息）
2015-02-22: 细节向核心白帽子及相关领域专家公开
2015-03-04: 细节向普通白帽子公开
2015-03-14: 细节向实习白帽子公开
2015-03-29: 细节向公众公开

简要描述：

最近更新日期（2014-12-26）
又更新了, 麻烦别再给5rank了 20走起可好。
一处是新的一处算是绕过补丁了。
之前还有一两个没打补丁哦加快速度把。

详细说明：

第一处新发现的在兑换奖品的时候在model/redeem.class.php中

function dh_action(){<br>
		$this->public_action();<br>
		if(!$this->uid && !$this->username)<br>
	    {<br>
		     $this->obj->ACT_layer_msg("您还没有登录，请先登录！",8,$_SERVER['HTTP_REFERER']);<br>
		}if($_POST['submit']){<br>
			if(!$_POST['password']){<br>
				$this->obj->ACT_layer_msg("密码不能为空！",8,$_SERVER['HTTP_REFERER']);<br>
			}<br>
			if(!$_POST['linkman'] || !$_POST['linktel'] ){<br>
				$this->obj->ACT_layer_msg("联系人或联系电话不能为空！",8,$_SERVER['HTTP_REFERER']);<br>
			}<br>
			$info=$this->obj->DB_select_once("member","`uid`='".$this->uid."'","`password`,`salt`");<br>
			$passwrod=md5(md5($_POST['password']).$info['salt']);<br>
			if($info['password']!=$passwrod){<br>
				$this->obj->ACT_layer_msg("密码不正确！",8,$_SERVER['HTTP_REFERER']);<br>
			}<br>
			if(!$this->uid && !$this->username){<br>
				 $this->obj->ACT_layer_msg("您还没有登录，请先登录！",8,$_SERVER['HTTP_REFERER']);<br>
			}else{<br>
				if($_POST['num']<1){<br>
					$this->obj->ACT_layer_msg("请填写正确的数量！",8,$_SERVER['HTTP_REFERER']);<br>
				}else{<br>
					if($_COOKIE['usertype']=="1"){<br>
						$table="member_statis";<br>
					}elseif($_COOKIE['usertype']=="2"){<br>
						$table="company_statis";<br>
					}elseif($_COOKIE['usertype']=="3"){<br>
						$table="lt_statis";<br>
					}elseif($_COOKIE['usertype']=="4"){<br>
						$table="px_train_statis";<br>
					}<br>
					$info=$this->obj->DB_select_once($table,"`uid`='".$this->uid."'","integral");<br>
					$gift=$this->obj->DB_select_once("reward","`id`='".(int)$_GET['id']."'");<br>
					if($_POST['num']>$gift['stock']){<br>
						$this->obj->ACT_layer_msg("已超出库存数量！",8,$_SERVER['HTTP_REFERER']);<br>
					}else{<br>
						if($gift['restriction']!="0"&&$_POST['num']>$gift['restriction']){<br>
							$this->obj->ACT_layer_msg("已超出限购数量！",8,$_SERVER['HTTP_REFERER']);<br>
						}else{<br>
							$integral=$gift['integral']*$_POST['num'];<br>
							if($info['integral']<$integral){<br>
								$this->obj->ACT_layer_msg("您的积分不足！",8,$_SERVER['HTTP_REFERER']);<br>
							}else{<br>
								$this->obj->company_invtal($this->uid,$integral,false,"积分兑换",true,2,'integral',24);<br>
								$value.="`uid`='".$this->uid."',";<br>
								$value.="`username`='".$this->username."',";<br>
								$value.="`usertype`='".$_COOKIE['usertype']."',";<br>
								$value.="`name`='".$gift['name']."',";<br>
								$value.="`gid`='".$gift['id']."',";<br>
								$value.="`linkman`='".$_POST['linkman']."',";<br>
								$value.="`linktel`='".$_POST['linktel']."',";<br>
								$value.="`body`='".$_POST['body']."',";<br>
								$value.="`integral`='".$integral."',";<br>
								$value.="`num`='".$_POST['num']."',";//这里被单引号了。<br>
								$value.="`ctime`='".time()."'";<br>
								$this->obj->DB_insert_once("change",$value);<br>
								$this->obj->DB_update_all("reward","`stock`=`stock`-".$_POST['num']."","`id`='".(int)$_GET['id']."'");//注意看这里 `stock`-".$_POST['num'] 直接把post来的带入到了查询当中 没有被单引号 再来看DB_update_all<br>
								$this->obj->ACT_layer_msg("兑换成功，请等待管理员审核！",9,$_SERVER['HTTP_REFERER']);<br>
							}<br>
						}<br>
					}<br>
				}<br>
			  }<br>
		}

function dh_action(){

$this->public_action();

if(!$this->uid && !$this->username)

{

$this->obj->ACT_layer_msg("您还没有登录，请先登录！",8,$_SERVER['HTTP_REFERER']);

}if($_POST['submit']){

if(!$_POST['password']){

$this->obj->ACT_layer_msg("密码不能为空！",8,$_SERVER['HTTP_REFERER']);

}

if(!$_POST['linkman'] || !$_POST['linktel'] ){

$this->obj->ACT_layer_msg("联系人或联系电话不能为空！",8,$_SERVER['HTTP_REFERER']);

}

$info=$this->obj->DB_select_once("member","`uid`='".$this->uid."'","`password`,`salt`");

$passwrod=md5(md5($_POST['password']).$info['salt']);

if($info['password']!=$passwrod){

$this->obj->ACT_layer_msg("密码不正确！",8,$_SERVER['HTTP_REFERER']);

}

if(!$this->uid && !$this->username){

$this->obj->ACT_layer_msg("您还没有登录，请先登录！",8,$_SERVER['HTTP_REFERER']);

}else{

if($_POST['num']<1){

$this->obj->ACT_layer_msg("请填写正确的数量！",8,$_SERVER['HTTP_REFERER']);

}else{

if($_COOKIE['usertype']=="1"){

$table="member_statis";

}elseif($_COOKIE['usertype']=="2"){

$table="company_statis";

}elseif($_COOKIE['usertype']=="3"){

$table="lt_statis";

}elseif($_COOKIE['usertype']=="4"){

$table="px_train_statis";

}

$info=$this->obj->DB_select_once($table,"`uid`='".$this->uid."'","integral");

$gift=$this->obj->DB_select_once("reward","`id`='".(int)$_GET['id']."'");

if($_POST['num']>$gift['stock']){

$this->obj->ACT_layer_msg("已超出库存数量！",8,$_SERVER['HTTP_REFERER']);

}else{

if($gift['restriction']!="0"&&$_POST['num']>$gift['restriction']){

$this->obj->ACT_layer_msg("已超出限购数量！",8,$_SERVER['HTTP_REFERER']);

}else{

$integral=$gift['integral']*$_POST['num'];

if($info['integral']<$integral){

$this->obj->ACT_layer_msg("您的积分不足！",8,$_SERVER['HTTP_REFERER']);

}else{

$this->obj->company_invtal($this->uid,$integral,false,"积分兑换",true,2,'integral',24);

$value.="`uid`='".$this->uid."',";

$value.="`username`='".$this->username."',";

$value.="`usertype`='".$_COOKIE['usertype']."',";

$value.="`name`='".$gift['name']."',";

$value.="`gid`='".$gift['id']."',";

$value.="`linkman`='".$_POST['linkman']."',";

$value.="`linktel`='".$_POST['linktel']."',";

$value.="`body`='".$_POST['body']."',";

$value.="`integral`='".$integral."',";

$value.="`num`='".$_POST['num']."',";//这里被单引号了。

$value.="`ctime`='".time()."'";

$this->obj->DB_insert_once("change",$value);

$this->obj->DB_update_all("reward","`stock`=`stock`-".$_POST['num']."","`id`='".(int)$_GET['id']."'");//注意看这里 `stock`-".$_POST['num'] 直接把post来的带入到了查询当中没有被单引号再来看DB_update_all

$this->obj->ACT_layer_msg("兑换成功，请等待管理员审核！",9,$_SERVER['HTTP_REFERER']);

}

}

function DB_update_all($tablename, $value, $where = 1){<br>
    	$SQL = "UPDATE `" . $this->def . $tablename . "` SET $value WHERE $where";<br>
 		$this->db->query("set sql_mode=''");<br>
		$return=$this->db->query($SQL);<br>
		return $return;<br>
	}

function DB_update_all($tablename, $value, $where = 1){

$SQL = "UPDATE `" . $this->def . $tablename . "` SET $value WHERE $where";

$this->db->query("set sql_mode=''");

$return=$this->db->query($SQL);

return $return;

}

查询查询但是我们来看看$_POST['num'] 之前有啥处理没。可以看到前面有三个比较。

if($_POST['num']<1){ //这里比较是否小于1 php弱语言 像1asdxx 都能过。<br>
					$this->obj->ACT_layer_msg("请填写正确的数量！",8,$_SERVER['HTTP_REFERER']);<br>
				}else{<br>
					if($_COOKIE['usertype']=="1"){<br>
						$table="member_statis";<br>
					}elseif($_COOKIE['usertype']=="2"){<br>
						$table="company_statis";<br>
					}elseif($_COOKIE['usertype']=="3"){<br>
						$table="lt_statis";<br>
					}elseif($_COOKIE['usertype']=="4"){<br>
						$table="px_train_statis";<br>
					}<br>
					$info=$this->obj->DB_select_once($table,"`uid`='".$this->uid."'","integral");<br>
					$gift=$this->obj->DB_select_once("reward","`id`='".(int)$_GET['id']."'");<br>
					if($_POST['num']>$gift['stock']){、//这里第二处比较 这里是把商品查询出来 看看他的库存。 然后与传递过来的num比较 所以这里我们num最好就为1 然后这里我先输出胰腺癌。 var_dump($_POST['num']>$gift['stock']);exit;<br>
这里的库存为100.  发现如果我传递的num为1asd之类的时候 竟然true了。。 那么就失败了, 然后再继续测试 当传递的num为1+asd就返回false 意味着成功了。 那么这里我们就添加一个加号。<br>
						$this->obj->ACT_layer_msg("已超出库存数量！",8,$_SERVER['HTTP_REFERER']);<br>
					}else{<br>
						if($gift['restriction']!="0"&&$_POST['num']>$gift['restriction']){<br>
							$this->obj->ACT_layer_msg("已超出限购数量！",8,$_SERVER['HTTP_REFERER']);<br>
						}else{

if($_POST['num']<1){ //这里比较是否小于1 php弱语言像1asdxx 都能过。

$this->obj->ACT_layer_msg("请填写正确的数量！",8,$_SERVER['HTTP_REFERER']);

}else{

if($_COOKIE['usertype']=="1"){

$table="member_statis";

}elseif($_COOKIE['usertype']=="2"){

$table="company_statis";

}elseif($_COOKIE['usertype']=="3"){

$table="lt_statis";

}elseif($_COOKIE['usertype']=="4"){

$table="px_train_statis";

}

$info=$this->obj->DB_select_once($table,"`uid`='".$this->uid."'","integral");

$gift=$this->obj->DB_select_once("reward","`id`='".(int)$_GET['id']."'");

if($_POST['num']>$gift['stock']){、//这里第二处比较这里是把商品查询出来看看他的库存。然后与传递过来的num比较所以这里我们num最好就为1 然后这里我先输出胰腺癌。 var_dump($_POST['num']>$gift['stock']);exit;

这里的库存为100. 发现如果我传递的num为1asd之类的时候竟然true了。。那么就失败了, 然后再继续测试当传递的num为1+asd就返回false 意味着成功了。那么这里我们就添加一个加号。

$this->obj->ACT_layer_msg("已超出库存数量！",8,$_SERVER['HTTP_REFERER']);

}else{

if($gift['restriction']!="0"&&$_POST['num']>$gift['restriction']){

$this->obj->ACT_layer_msg("已超出限购数量！",8,$_SERVER['HTTP_REFERER']);

}else{

那么我们就能绕过这个判断了。

UPDATE phpyun_reward SET stock=stock-1+1,name=(select concat(username,0x23,password) from php_admin_user) WHERE id='1'此时执行的语句

这里随便说一下补丁解决泄漏key的那个方法太渣了把。。很轻松的就绕过去了。这里不多说，简直。。第二处在 api\alipay\alipayto.php

require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");<br>
require_once(dirname(dirname(dirname(__FILE__)))."/data/db.safety.php");//添加了过滤的进来。<br>
require_once(dirname(dirname(dirname(__FILE__)))."/plus/config.php");require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");<br>
$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);<br>
if(!is_numeric($_POST['dingdan'])){die;}$_COOKIE['uid']=(int)$_COOKIE['uid'];<br>
$_POST['is_invoice']=(int)$_POST['is_invoice'];<br>
$_POST['balance']=(int)$_POST['balance'];<br>
$member_sql=$db->query("SELECT * FROM `".$db_config["def"]."member` WHERE `uid`='".$_COOKIE['uid']."' limit 1");<br>
$member=mysql_fetch_array($member_sql);<br>
if($member['username'] != $_COOKIE['username'] || $member['usertype'] != $_COOKIE['usertype']||md5($member['username'].$member['password'].$member['salt'])!=$_COOKIE['shell']){<br>
	echo '登录信息验证错误，请重新登录！';die;<br>
}<br>
$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='".$_POST['dingdan']."' AND `order_price`>=0");<br>
$row=mysql_fetch_array($sql);<br>
if(!$row['uid'] || $row['uid']!=$_COOKIE['uid'])<br>
{<br>
	die;<br>
}<br>
if((int)$_POST['is_invoice']=='1'&&$config["sy_com_invoice"]){<br>
	$invoice_title=",`is_invoice`='".$_POST['is_invoice']."'";<br>
	if($_POST['linkway']=='1'){<br>
		$com_sql=$db->query("select `linkman`,`linktel`,`address` from `".$db_config["def"]."company` where `uid`='".$_COOKIE['uid']."'");//查询余额<br>
		$company=mysql_fetch_array($com_sql);<br>
		$link=",'".$company['linkman']."','".$company['linktel']."','".$company['address']."'";<br>
		$up_record=",`link_man`='".$company['linkman']."',`link_moblie`='".$company['linktel']."',`address`='".$company['address']."'";<br>
	}else{<br>
		$link=",'".$_POST['link_man']."','".$_POST['link_moblie']."','".$_POST['address']."'";<br>
		$up_record=",`link_man`='".$_POST['link_man']."',`link_moblie`='".$_POST['link_moblie']."',`address`='".$_POST['address']."'";<br>
	}<br>
	$record_sql=$db->query("select `id` from `".$db_config["def"]."invoice_record` where `order_id`='".$_POST['dingdan']."' and `uid`='".$_COOKIE['uid']."'");<br>
	$record=mysql_fetch_array($record_sql);<br>
	if($record['id']){<br>
		$upr_sql=$db->query("update `".$db_config["def"]."invoice_record` set `title`='".trim($_POST['invoice_title'])."',`status`='0',`addtime`='".time()."'".$up_record." where `id`='".$record['id']."'");<br>
		mysql_fetch_array($upr_sql);

require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");

require_once(dirname(dirname(dirname(__FILE__)))."/data/db.safety.php");//添加了过滤的进来。

require_once(dirname(dirname(dirname(__FILE__)))."/plus/config.php");require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");

$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);

if(!is_numeric($_POST['dingdan'])){die;}$_COOKIE['uid']=(int)$_COOKIE['uid'];

$_POST['is_invoice']=(int)$_POST['is_invoice'];

$_POST['balance']=(int)$_POST['balance'];

$member_sql=$db->query("SELECT * FROM `".$db_config["def"]."member` WHERE `uid`='".$_COOKIE['uid']."' limit 1");

$member=mysql_fetch_array($member_sql);

if($member['username'] != $_COOKIE['username'] || $member['usertype'] != $_COOKIE['usertype']||md5($member['username'].$member['password'].$member['salt'])!=$_COOKIE['shell']){

echo '登录信息验证错误，请重新登录！';die;

}

$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='".$_POST['dingdan']."' AND `order_price`>=0");

$row=mysql_fetch_array($sql);

if(!$row['uid'] || $row['uid']!=$_COOKIE['uid'])

{

die;

}

if((int)$_POST['is_invoice']=='1'&&$config["sy_com_invoice"]){

$invoice_title=",`is_invoice`='".$_POST['is_invoice']."'";

if($_POST['linkway']=='1'){

$com_sql=$db->query("select `linkman`,`linktel`,`address` from `".$db_config["def"]."company` where `uid`='".$_COOKIE['uid']."'");//查询余额

$company=mysql_fetch_array($com_sql);

$link=",'".$company['linkman']."','".$company['linktel']."','".$company['address']."'";

$up_record=",`link_man`='".$company['linkman']."',`link_moblie`='".$company['linktel']."',`address`='".$company['address']."'";

}else{

$link=",'".$_POST['link_man']."','".$_POST['link_moblie']."','".$_POST['address']."'";

$up_record=",`link_man`='".$_POST['link_man']."',`link_moblie`='".$_POST['link_moblie']."',`address`='".$_POST['address']."'";

}

$record_sql=$db->query("select `id` from `".$db_config["def"]."invoice_record` where `order_id`='".$_POST['dingdan']."' and `uid`='".$_COOKIE['uid']."'");

$record=mysql_fetch_array($record_sql);

if($record['id']){

$upr_sql=$db->query("update `".$db_config["def"]."invoice_record` set `title`='".trim($_POST['invoice_title'])."',`status`='0',`addtime`='".time()."'".$up_record." where `id`='".$record['id']."'");

mysql_fetch_array($upr_sql);

可以看到 data/db.safety.php 把过滤文件添加进来了。那么这里的$_POST我们就不能引入单引号了。但是。。

if($_POST['linkway']=='1'){<br>
		$com_sql=$db->query("select `linkman`,`linktel`,`address` from `".$db_config["def"]."company` where `uid`='".$_COOKIE['uid']."'");//查询余额<br>
		$company=mysql_fetch_array($com_sql);<br>
		$link=",'".$company['linkman']."','".$company['linktel']."','".$company['address']."'";//当linkway为1的时候 这里拼接的是出库来的 。。<br>
		$up_record=",`link_man`='".$company['linkman']."',`link_moblie`='".$company['linktel']."',`address`='".$company['address']."'";<br>
	}else{<br>
		$link=",'".$_POST['link_man']."','".$_POST['link_moblie']."','".$_POST['address']."'";<br>
		$up_record=",`link_man`='".$_POST['link_man']."',`link_moblie`='".$_POST['link_moblie']."',`address`='".$_POST['address']."'";<br>
	}