当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062045

漏洞标题：YouYaX某处SQL注入

相关厂商：youyax.com

漏洞作者： 只发通用型

提交时间：2014-05-27 10:36

修复时间：2014-08-25 10:38

公开时间：2014-08-25 10:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-27： 细节已通知厂商并且等待厂商处理中
2014-05-27： 厂商已经确认，细节仅向厂商公开
2014-07-21： 细节向核心白帽子及相关领域专家公开
2014-07-31： 细节向普通白帽子公开
2014-08-10： 细节向实习白帽子公开
2014-08-25： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

YouYaX是良心厂商~所以来刷点洞，第一个

详细说明：

/ext/register.php 文件
当($mix['is_prevent_reg']为true时

if($mix['is_prevent_reg']){
		if (!empty($_SERVER['HTTP_CLIENT_IP']))
        $myIp = $_SERVER['HTTP_CLIENT_IP'];
    else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
        $myIp = $_SERVER['HTTP_X_FORWARDED_FOR'];
    else
        $myIp = $_SERVER['REMOTE_ADDR'];
    $sql    = "select * from " . $config['db_prefix'] . "user where ip_addr='" . $myIp . "'";
    $result = mysql_query($sql);
    $num    = mysql_num_rows($result);


可以伪造IP进行注入，因为不回显应该是用延时注入比较合适.
这里echo 出sql语句做一下漏洞证明

1.jpg

漏洞证明：

1.jpg


为了管理员复现漏洞方便（该CMS还要配置邮件服务器，我注释这些代码）
复制了我的代码上来你复现直接粘贴上去就可以了

<?php
include('../ext_public/include.php');
include('../ext_public/database.php');
function doUserCount($param){
	$count_arr = mysql_fetch_array(mysql_query("select * from " . $param . "count where id=1"));
	$data=unserialize($count_arr['user_count']);
	$date=date('w', time());
	$date2=date('W',time());
	if($date2 != $count_arr['week_order']){
  	mysql_query("update " . $param . "count set user_count='',post_count='',week_order='".$date2."' where id=1");
  	$count_arr = mysql_fetch_array(mysql_query("select * from " . $param . "count where id=1"));
		$data=unserialize($count_arr['user_count']);
	}
		switch($date){
			case 0:
				@$data['g']++;
				break;
			case 1:
				@$data['a']++;
				break;
			case 2:
				@$data['b']++;
				break;
			case 3:
				@$data['c']++;
				break;
			case 4:
				@$data['d']++;
				break;
			case 5:
				@$data['e']++;
				break;
			case 6:
				@$data['f']++;
				break;
		}
  	mysql_query("update " . $param . "count set user_count='".serialize($data)."' where id=1");
}
if (isset($_POST['sub'])) {
	if(empty($config['default_user_group'])||empty($config['not_log_in_user_group'])){
    	echo "<script>alert('请至后台[注册激活管理-配置]设置注册和未登陆默认用户组');</script>";
    	exit;
    }
    $user = htmlspecialchars(addslashes(trim($_POST['user'])), ENT_QUOTES, "UTF-8");
    if(mb_strlen($user,'utf8')>7 || mb_strlen($user,'utf8')<2){
    	echo "<script>alert('用户名长度必须在2~7个字符之间');</script>";
      echo "<script>window.parent.location.href='" . url_site . "';</script>";
      exit;
    }
    if (empty($_POST['pass'])) {
        echo "<script>alert('密码必填');</script>";
        echo "<script>window.parent.location.href='" . url_site . "';</script>";
        exit;
    }
    $pass = md5(addslashes($_POST['pass']));
    $_POST['email']=addslashes($_POST['email']);
    if (empty($_POST['email'])) {
        echo "<script>alert('邮箱名必填');</script>";
        echo "<script>window.parent.location.href='" . url_site . "';</script>";
        exit;
    }
	if($mix['is_prevent_reg']){
		if (!empty($_SERVER['HTTP_CLIENT_IP']))
        $myIp = $_SERVER['HTTP_CLIENT_IP'];
    else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
        $myIp = $_SERVER['HTTP_X_FORWARDED_FOR'];
    else
        $myIp = $_SERVER['REMOTE_ADDR'];
    $sql    = "select * from " . $config['db_prefix'] . "user where ip_addr='" . $myIp . "'";
    $result = mysql_query($sql);
    var_dump($sql);
    $num    = mysql_num_rows($result);
	    if($num >= $mix['prevent_reg_num']){
	    	echo "<script>alert('注册失败,此IP地址已经使用超过 ".$mix['prevent_reg_num']." 次了');</script>";
	      echo "<script>window.parent.location.href='" . url_site . "';</script>";
	      exit;
	    }
	}
    $code = '';
    for ($i = 0; $i < 6; $i++) {
        $code .= mt_rand(0, 9);
    }
    if($config['register_mode']==1){
/*	    $mailconf = require("../Conf/mail.config.php");
	    if(empty($mailconf['mail_Host'])&&empty($mailconf['mail_Username'])&&empty($mailconf['mail_Password'])){
	    	echo "<script>alert('管理员后台未配置邮件服务器');</script>";
	    	exit;
	    }*/
    }
    mysql_query("SET NAMES 'utf8'");
    mysql_query("SET sql_mode=''");
    date_default_timezone_set('Asia/Shanghai');
    $sql    = "select * from " . $config['db_prefix'] . "user where user='" . $user . "'";
    $result = mysql_query($sql);
    $num    = mysql_num_rows($result);
    //判断是否被注册
    if ($num > 0) {
        echo "<script>alert('该用户名已被注册');</script>";
        echo "<script>window.parent.location.href='" . url_site . "';</script>";
    } else {
        $sql2    = "select * from " . $config['db_prefix'] . "user where email='" . $_POST['email'] . "'";
        $result2 = mysql_query($sql2);
        $num2    = mysql_num_rows($result2);
        if ($num2 > 0) {
            echo "<script>alert('邮箱名已被注册');</script>";
            echo "<script>window.parent.location.href='" . url_site . "';</script>";
            exit;
        } else {
        if($config['register_mode']==1){
/*        	   require_once("../ext_public/phpmailer/class.phpmailer.php");
            $mail     = new PHPMailer();
            $mail->IsSMTP();
            $mail->Host     = $mailconf['mail_Host'];
            $mail->SMTPAuth = true;
            $mail->Username = $mailconf['mail_Username'];
            $mail->Password = $mailconf['mail_Password'];
            $mail->From     = $mailconf['mail_From'];
            $mail->FromName = $mailconf['mail_FromName'];
            $mail->AddAddress($_POST['email']);
            $mail->IsHTML(true);
            $mail->CharSet  = "UTF-8";
            $mail->Encoding = "base64";
            $mail->Subject  = $mailconf['mail_Subject'];
            $mail->Body     = $mailconf['mail_Body'] . "<a href='" . url_site . "/ext/mail_active.php?user=" . $user . "&pass=" . $pass . "&email=" . $_POST['email'] . "&code=" . $code . "'>点此激活</a>";
            if (!empty($_POST['email'])) {
                exit;
            }*/
            if($mix['is_prevent_reg']){
            	$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,ip_addr,user_group) values('" . $user . "','" . $pass . "',0,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','" . $code . "','".$myIp."','".$config['default_user_group']."')";
            }else{
            	$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,user_group) values('" . $user . "','" . $pass . "',0,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','" . $code . "','".$config['default_user_group']."')";
            }
            mysql_query($sql);
            doUserCount($config['db_prefix']);
            echo "<script>alert('注册成功,请至邮箱激活!');</script>";
            echo "<script>window.parent.location.href='" . url_site . "';</script>";
        }else{
	      	if(addslashes($_POST['valicode'])!=$_SESSION['verify']){
	      		echo "<script>alert('输入的验证码不正确!');</script>";
	      		exit;
	      	}else{
	      		if($mix['is_prevent_reg']){
	      			$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,ip_addr,user_group) values('" . $user . "','" . $pass . "',1,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','". $code . "','".$myIp."','".$config['default_user_group']."')";
	      		}else{
	          	$sql = "insert into " . $config['db_prefix'] . "user(user,pass,status,email,complete,face,time,fatieshu,bid,codes,user_group) values('" . $user . "','" . $pass . "',1,'" . $_POST['email'] . "','0','00.gif',now(),0,'".$mix['bid_init']."','". $code . "','".$config['default_user_group']."')";
                }
	          mysql_query($sql);
	          doUserCount($config['db_prefix']);
	          echo "<script>alert('注册成功!');</script>";
	          $_SESSION['youyax_data'] = 1;
	          $_SESSION['youyax_user'] = $user;
	          $_SESSION['youyax_bz']   = 1;
	          echo "<script>window.parent.location.href='" . url_site . "';</script>";
	      	}
      	 }
      }
    }
}
?>

修复方案：

对IP正则判断

版权声明：转载请注明来源 只发通用型@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-05-27 12:19

厂商回复：

似乎可以绕过注册限制，多谢反馈

最新状态：

2014-05-27：公开漏洞是为了在程序发展初期，无太多用户积累的情况下更好的检测安全性