duxcms SQL Injection In /admin/module/loginMod.class.php

<span>1</span><span>. 漏洞描述
</span><span>2</span><span>. 漏洞触发条件
</span><span>3</span><span>. 漏洞影响范围
</span><span>4</span><span>. 漏洞代码分析
</span><span>5</span><span>. 防御方法
</span><span>6</span>. 攻防思考

http:<span>//</span><span>www.wooyun.org/bugs/wooyun-2010-063055</span>

<span>1</span><span>. 用户名
</span>-<span>1</span><span>"</span><span> union select 1,2,3,'c4ca4238a0b923820dcc509a6f75849b',5,6,7,8,9,10,11#</span>
<span>/*</span><span>
这里的md5就是数字1的md5
</span><span>*/</span>

<span>2</span>. 密码: <span>1</span>

<span>//</span><span>登陆检测</span>
<span>public</span><span> function check()
{
    </span><span>if</span>(empty($_POST[<span>'</span><span>user</span><span>'</span>]) || empty($_POST[<span>'</span><span>password</span><span>'</span><span>]))
    {
        $</span><span>this</span>->msg(<span>'</span><span>帐号信息输入错误!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>//</span><span>获取帐号信息</span>
    <span>/*</span><span>
    这里是漏洞关键，程序未对用户的输入进行正确的过滤、转义
    </span><span>*/</span><span>
    $info </span>= model(<span>'</span><span>login</span><span>'</span>)->user_info($_POST[<span>'</span><span>user</span><span>'</span><span>]); 

    </span><span>//</span><span>进行帐号验证</span>
    <span>if</span><span>(empty($info))
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 无此管理员帐号!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>if</span>($info[<span>'</span><span>password</span><span>'</span>] <> md5($_POST[<span>'</span><span>password</span><span>'</span><span>]))
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 密码错误!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>if</span>($info[<span>'</span><span>status</span><span>'</span>]==<span>0</span><span>)
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 帐号已禁用!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>//</span><span>更新帐号信息</span>
    $data[<span>'</span><span>logintime</span><span>'</span>]=<span>time();
    $data[</span><span>'</span><span>ip</span><span>'</span>]=<span>get_client_ip();
    $data[</span><span>'</span><span>loginnum</span><span>'</span>]=intval($info[<span>'</span><span>loginnum</span><span>'</span>])+<span>1</span><span>;
    model(</span><span>'</span><span>login</span><span>'</span>)->edit($data,intval($info[<span>'</span><span>id</span><span>'</span><span>]));
    </span><span>//</span><span>更新登录记录</span>
    model(<span>'</span><span>log</span><span>'</span>)-><span>login_log($info);
    </span><span>//</span><span>设置登录信息</span>
    $_SESSION[$<span>this</span>->config[<span>'</span><span>SPOT</span><span>'</span>].<span>'</span><span>_user</span><span>'</span>]=$info[<span>'</span><span>id</span><span>'</span><span>];
    model(</span><span>'</span><span>user</span><span>'</span>)->current_user(<span>false</span><span>);
    $</span><span>this</span>->msg(<span>'</span><span>登录成功!</span><span>'</span>,<span>1</span><span>);        
}</span>

<span>//</span><span>登陆检测</span>
<span>public</span><span> function check()
{
    </span><span>if</span>(empty($_POST[<span>'</span><span>user</span><span>'</span>]) || empty($_POST[<span>'</span><span>password</span><span>'</span><span>]))
    {
        $</span><span>this</span>->msg(<span>'</span><span>帐号信息输入错误!</span><span>'</span>,<span>0</span><span>);
    }

    </span><span>//</span><span>sql注入防御</span>
    $_POST[<span>'</span><span>user</span><span>'</span>] = addslashes($_POST[<span>'</span><span>user</span><span>'</span><span>]);
    $_POST[</span><span>'</span><span>password</span><span>'</span>] = addslashes($_POST[<span>'</span><span>password</span><span>'</span><span>]);
    </span><span>//</span><span>获取帐号信息</span>
    <span>/*</span><span>
    这里是漏洞关键，程序未对用户的输入进行正确的过滤、转义
    </span><span>*/</span><span>
    $info </span>= model(<span>'</span><span>login</span><span>'</span>)->user_info($_POST[<span>'</span><span>user</span><span>'</span><span>]); 

    </span><span>//</span><span>进行帐号验证</span>
    <span>if</span><span>(empty($info))
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 无此管理员帐号!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>if</span>($info[<span>'</span><span>password</span><span>'</span>] <> md5($_POST[<span>'</span><span>password</span><span>'</span><span>]))
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 密码错误!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>if</span>($info[<span>'</span><span>status</span><span>'</span>]==<span>0</span><span>)
    {
        $</span><span>this</span>->msg(<span>'</span><span>登录失败! 帐号已禁用!</span><span>'</span>,<span>0</span><span>);
    }
    </span><span>//</span><span>更新帐号信息</span>
    $data[<span>'</span><span>logintime</span><span>'</span>]=<span>time();
    $data[</span><span>'</span><span>ip</span><span>'</span>]=<span>get_client_ip();
    $data[</span><span>'</span><span>loginnum</span><span>'</span>]=intval($info[<span>'</span><span>loginnum</span><span>'</span>])+<span>1</span><span>;
    model(</span><span>'</span><span>login</span><span>'</span>)->edit($data,intval($info[<span>'</span><span>id</span><span>'</span><span>]));
    </span><span>//</span><span>更新登录记录</span>
    model(<span>'</span><span>log</span><span>'</span>)-><span>login_log($info);
    </span><span>//</span><span>设置登录信息</span>
    $_SESSION[$<span>this</span>->config[<span>'</span><span>SPOT</span><span>'</span>].<span>'</span><span>_user</span><span>'</span>]=$info[<span>'</span><span>id</span><span>'</span><span>];
    model(</span><span>'</span><span>user</span><span>'</span>)->current_user(<span>false</span><span>);
    $</span><span>this</span>->msg(<span>'</span><span>登录成功!</span><span>'</span>,<span>1</span><span>);        
}</span>