测试环境：php5.3
测试目标：espcms_utf8_5.5.12.10.08
测试目的：使用COOKIE进行注入
产生COOKIE漏洞的原因：
upload\interface\order.php文件下：
function in_list() {
parent::start_pagetemplate();
$lng = (admin_LNG == 'big5') ? $this->CON['is_lancode'] : admin_LNG;
$cartid = $this->fun->accept('ecisp_order_list', 'C');
$cartid = stripslashes(htmlspecialchars_decode($cartid));
$uncartid = !empty($cartid) ? unserialize($cartid) : 0;
if ($uncartid && is_array($uncartid)) {
$didarray = $this->fun->key_array_name($uncartid, 'did', 'amount');
$didlist = $this->fun->format_array_text(array_keys($didarray), ',');
if (!empty($didlist)) {
$db_table = db_prefix . 'document';
$db_where = "isclass=1 AND isorder=1 AND did in($didlist) ORDER BY did DESC";
$sql = "SELECT did,lng,pid,mid,aid,tid,sid,fgid,linkdid,isclass,islink,ishtml,ismess,isorder,purview,recommend,tsn,title,longtitle,
color,author,source,pic,link,oprice,bprice,click,addtime,template,filename,filepath FROM $db_table WHERE $db_where";
$rs = $this->db->query($sql);
$productmoney = 0;
while ($rsList = $this->db->fetch_assoc($rs)) {
$rsList['link'] = $this->get_link('doc', $rsList, admin_LNG);
$rsList['buylink'] = $this->get_link('buylink', $rsList, admin_LNG);
$rsList['enqlink'] = $this->get_link('enqlink', $rsList, admin_LNG);
$rsList['dellink'] = $this->get_link('buydel', $rsList, admin_LNG);
$rsList['ctitle'] = empty($rsList['color']) ? $rsList['title'] : "<font color='" . $rsList['color'] . "'>" . $rsList['title'] . "</font>";
$rsList['amount'] = $didarray[$rsList['did']];
$countprice = sprintf("%01.2f", $didarray[$rsList['did']] * $rsList['bprice']);
$rsList['countprice'] = $countprice;
$productmoney = $productmoney + $countprice;
$array[] = $rsList;
}
$this->fun->setcookie('ecisp_order_productmoney', $productmoney, 7200);
}
$this->pagetemplate->assign('ordertotal', number_format($productmoney, 2));
$this->pagetemplate->assign('array', $array);
$order_integral = empty($this->CON['order_integral']) ? 1 : intval($this->CON['order_integral']);
$internum = $productmoney * $order_integral;
$this->pagetemplate->assign('internum', intval($internum));
$this->pagetemplate->assign('moneytype', $this->CON['order_moneytype']);
} else {
$this->pagetemplate->assign('ordervirtue', 'false');
}
$this->pagetemplate->assign('mlink', $this->mlink);
$templatesDIR = $this->get_templatesdir('order');
$this->pagetemplate->assign('path', 'order');
$templatefilename = $lng . '/' . $templatesDIR . '/order_buy_center';
$this->pagetemplate->assign('out', 'buylist');
unset($array, $this->mlink, $LANPACK, $this->lng);
$this->pagetemplate->display($templatefilename, 'order_list', false, '', admin_LNG);
}
定位出这行执行行：
$cartid = $this->fun->accept('ecisp_order_list', 'C');
将源码放入Seay项目审计系统，定位accept：
function accept($k, $var='R', $ectype='bu') {
switch ($var) {
case 'G':
$var = &$_GET;
break;
case 'P':
$var = &$_POST;
break;
case 'C':
$var = &$_COOKIE;
break;
case 'R':
$var = &$_REQUEST;
break;
}
$vluer = $var[$k];
return isset($vluer) ? daddslashes($vluer, 1) : NULL;
}
证明accept是用来获取cookie的，上面截取出来的这个就是获取代码
case 'C':
$var = &$_COOKIE;
break;
源代码上的漏洞分两组情况
1.写代码(一定执行)
2.写函数(不一定执行，需要找到带有此函数执行的页面)
上面是属于在函数的情况，需要找到使用这个函数的源代码
全局搜索in_list()这个函数在哪个文件被调用、包含，声明的文件全部不算。
找不到对函数的直接调用，就找它的上一级，定义这个函数的方法(class):mainpage
==> 原因：函数的名字被拆解了，属于组合后实现函数效果的那种
全局搜索 new mainpage 找到对它的调用
index.php下：
$archive = indexget('ac', 'R');
$action = indexget('at', 'R'); // at接收
if (empty($archive) || empty($action)) {
include admin_ROOT . 'interface/public.php';
$mainlist = new mainpage();
if (method_exists($mainlist, 'in_index')) {
$mainlist->in_index();
} else {
exit('Access error!');
}
} else {
if (in_array($archive, array('article', 'forum', 'search', 'bbssearch', 'forummain', 'messmain', 'special', 'respond', 'public', 'scriptout', 'enquiry', 'enquirymain', 'form', 'formmain', 'ordermain', 'membermain', 'member', 'forum', 'order'))) {
$action = 'in_' . $action;
if (!file_exists(admin_ROOT . "interface/$archive.php")) {
exit('Access error!');
}
include admin_ROOT . "interface/$archive.php";
$mainlist = new mainpage();
if (method_exists($mainlist, $action)) {
$mainlist->$action();
} else {
exit('Access error!');
}
} else {
exit('Access error!');
}
}
-------------
分析：
$action = indexget('at', 'R');
$action = 'in_' . $action;
==> 最后是在cookie进行注入
|
wechat
alipay
