【90Sec Team】新年贺礼之——PHPCMS v9.6.0 SQL注入漏洞分析

【90Sec Team】新年贺礼之——PHPCMS v9.6.0 SQL注入漏洞分析

function safe_replace($string) {     $string = str_replace('%20','',$string);     $string = str_replace('%27','',$string);     $string = str_replace('%2527','',$string);     $string = str_replace('*','',$string);     $string = str_replace('"','"',$string);     $string = str_replace("'",'',$string);     $string = str_replace('"','',$string);     $string = str_replace(';','',$string);     $string = str_replace('<','<',$string);     $string = str_replace('>','>',$string);     $string = str_replace("{",'',$string);     $string = str_replace('}','',$string);     $string = str_replace('//','',$string);     return $string; }

 所以，phpcms也开始针对这个问题进行改进，这里引入mysqli这个封装类就是证明了这一点。不过，在v9.5.10中，默认使用的mysql封装类还是mysql:

根据配置文件在db_factory类中加载：

而在v9.6.0版本中，默认的mysql封装类换成了mysqli：

public function connect() {     $func = $this->config['pconnect'] == 1 ? 'mysql_pconnect' : 'mysql_connect';     if(!$this->link = @$func($this->config['hostname'], $this->config['username'], $this->config['password'], 1)) {         $this->halt('Can not connect to MySQL server');         return false;     }       if($this->version() > '4.1') {         $charset = isset($this->config['charset']) ? $this->config['charset'] : '';         $serverset = $charset ? "character_set_connection='$charset',character_set_results='$charset',character_set_client=binary" : '';         $serverset .= $this->version() > '5.0.1' ? ((empty($serverset) ? '' : ',')." sql_mode='' ") : '';         $serverset && mysql_query("SET $serverset", $this->link);            }       if($this->config['database'] && !@mysql_select_db($this->config['database'], $this->link)) {         $this->halt('Cannot use database '.$this->config['database']);         return false;     }     $this->database = $this->config['database'];     return $this->link; }

/libs/classes/db_mysqli.php

public function connect() {           $this->link = new mysqli($this->config['hostname'], $this->config['username'], $this->config['password'], $this->config['database'], $this->config['port']?intval($this->config['port']):3306);       if(mysqli_connect_errno()){         $this->halt('Can not connect to MySQL server');         return false;     }     if($this->version() > '4.1') {         $charset = isset($this->config['charset']) ? $this->config['charset'] : '';         $this->link->set_charset($charset);         $serverset = $this->version() > '5.0.1' ? 'sql_mode=/'/'' : '';         $serverset && $this->link->query("SET $serverset");     }     return $this->link; }

有何区别？mysql比db_mysqli里多了一段：

if($this->version() > '4.1') {         $charset = isset($this->config['charset']) ? $this->config['charset'] : '';         $serverset = $charset ? "character_set_connection='$charset',character_set_results='$charset',character_set_client=binary" : '';         $serverset .= $this->version() > '5.0.1' ? ((empty($serverset) ? '' : ',')." sql_mode='' ") : '';         $serverset && mysql_query("SET $serverset", $this->link);            }

public function public_forget_password () {     $email_config = getcache('common', 'commons');           //SMTP MAIL 二种发送模式     if($email_config['mail_type'] == '1'){         if(empty($email_config['mail_user']) || empty($email_config['mail_password'])) {             showmessage(L('email_config_empty'), HTTP_REFERER);         }     }     $this->_session_start();     $member_setting = getcache('member_setting');     if(isset($_POST['dosubmit'])) {         if ($_SESSION['code'] != strtolower($_POST['code'])) {             showmessage(L('code_error'), HTTP_REFERER);         }         $memberinfo = $this->db->get_one(array('email'=>$_POST['email']));

 可见这里直接将email传入get_one函数，一定存在注入。前面有个验证码的检测，实际上是可以绕过的，只要我们不传入code即可。

public function swfdelete() {     $attachment = pc_base::load_sys_class('attachment');     $att_del_arr = explode('|',$_GET['data']);     foreach($att_del_arr as $n=>$att){         if($att) $attachment->delete(array('aid'=>$att,'userid'=>$this->userid,'uploadip'=>ip()));     } }